CVE-2026-13415: CMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Privilege Escalation via cmp_ajax_import_settings
The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls) to update arbitrary WordPress options, including options that lead to privilege escalation to Administrator.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress CMP pluginto a version that resolves this vulnerability.Fixed in 4.1.18 - Configuration
Update the CMP plugin so that AJAX import actions enforce an option-name allow-list, preventing arbitrary WordPress option updates (including options that can lead to privilege escalation).
CMP WordPress plugin enforce option-name allow-list for AJAX settings import = enabled
Event History
Frequently Asked Questions
Which sites are realistically exposed to this issue?
Sites using CMP versions before 4.1.18 are exposed only if an administrator has granted the WordPress Editor role access to CMP through its admin-bar controls. Editor accounts are the relevant attacker population.
What level of access does an attacker need?
An attacker needs an authenticated WordPress account with the Editor role and access to the CMP plugin's admin-bar controls. They can use the cmp_ajax_import_settings AJAX action to modify arbitrary WordPress options, including options that can result in Administrator-level privileges.
Is the default configuration affected?
The issue depends on an administrator granting Editors access to CMP through the plugin's admin-bar controls. The provided information does not establish that Editors have this access by default.