Description

The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls) to update arbitrary WordPress options, including options that lead to privilege escalation to Administrator.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-27T06:16:55.537Z",
  "pubdate": "2026-08-27T06:16:55.537Z",
  "executiveSummary": "The CMP WordPress plugin, in versions prior to 4.1.18, contains a critical security vulnerability involving improper access control during AJAX-based settings imports. The vulnerability resides in the plugin's failure to enforce a secure allow-list for option names when updating site settings.\nThis flaw allows an authenticated user with the 'Editor' role—specifically when granted administrative access to CMP plugin controls—to perform unauthorized modifications to any arbitrary WordPress database option. By overwriting critical configuration options, an attacker can manipulate system-wide settings, facilitating privilege escalation to the Administrator level.\nThe risk is categorized as high due to the potential for full site compromise. Successful exploitation requires the attacker to possess Editor-level privileges and access to the plugin's interface. Once these conditions are met, the attacker can manipulate the WordPress options table, effectively bypassing standard role-based access controls to gain unrestricted administrative authority over the WordPress installation.\nImmediate remediation is required by updating the CMP plugin to version 4.1.18 or higher to ensure the implementation of robust input validation and option name verification.",
  "technicalDetails": "The root cause of this vulnerability is the improper implementation of settings import functionality within the CMP plugin's AJAX handlers. Specifically, the plugin does not validate or restrict the keys processed during the settings import operation against a predefined allow-list. This lack of sanitization and validation allows the input mechanism to pass arbitrary key-value pairs directly to the WordPress update_option() function.\nThe vulnerable component is the AJAX endpoint responsible for processing settings imports. When a request is initiated, the application logic fails to check if the provided option name is permitted for modification. Consequently, any user granted access to the CMP interface can influence the global wp_options table.\nThe attack flow begins when an authenticated Editor navigates to the CMP plugin interface. The user provides a crafted payload intended for the settings import action. Because the server-side code accepts these parameters without verifying the intent or scope of the configuration keys, the application executes a series of update_option() calls based on the provided input.\nA typical exploitation vector involves modifying sensitive options such as 'users_can_register' or 'default_role'. By setting 'users_can_register' to '1' and 'default_role' to 'administrator', an attacker can register a new account that is automatically promoted to the highest privilege level. Alternatively, an attacker may target 'siteurl' or other critical identifiers to redirect traffic or disable security plugins. Because the plugin processes these options during an import action, the modification occurs within the context of the WordPress process, bypassing administrative validation routines typically reserved for the main WordPress settings dashboard.\nThis vulnerability is strictly authenticated, requiring the attacker to possess at least Editor permissions. However, the secondary requirement—the granting of CMP plugin access to the Editor—significantly increases the attack surface in multi-user environments where administrative duties are delegated. The impact is catastrophic, resulting in total administrative compromise and the potential for persistent backdoors or data exfiltration from the WordPress database."
}