CVE-2026-12470: CMP <= 4.1.17 - Authenticated (Editor+) Privilege Escalation via Arbitrary Option Update to cmp_ajax_import_settings AJAX Action
The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'cmpajaximportsettings' AJAX action in all versions up to, and including, 4.1.17. This makes it possible for authenticated attackers, with Editor-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with Editor-level access or higher can exploit it. The attack is network-accessible and does not require user interaction.
What must be true for an attacker to gain administrator access?
The attacker needs an existing Editor-or-higher account and the vulnerable plugin version. They can change WordPress options to enable registration and set the default registration role to administrator, then register an administrative account.
Are sites affected if public registration is currently disabled?
Yes. An eligible authenticated attacker can use the vulnerable AJAX action to enable user registration and change the default role, so disabled registration does not prevent exploitation.
What versions are affected?
All versions of the CMP – Coming Soon & Maintenance Plugin through 4.1.17, inclusive, are affected.
How can I check whether the escalation path may have been used?
Review WordPress settings for unexpected enabled user registration or an administrator default role for new registrations. Also investigate newly created administrator accounts, especially accounts created after an Editor-level user may have accessed the site.