CVE-2026-6518: CMP – Coming Soon & Maintenance Plugin by NiteoThemes <= 4.1.16 - Missing Authorization to Authenticated (Administrator+) Arbitrary File Upload and Remote Code Execution
The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to arbitrary file upload and remote code execution in all versions up to, and including, 4.1.16 via the cmpthemeupdateinstall AJAX action. This is due to the function only checking for the publishpages capability (available to Editors and above) instead of manageoptions (Administrators only), combined with a lack of proper validation on the user-supplied file URL and no verification of the downloaded file's content before extraction. This makes it possible for authenticated attackers, with Administrator-level access and above, to force the server to download and extract a malicious ZIP file from a remote attacker-controlled URL into a web-accessible directory (wp-content/plugins/cmp-premium-themes/), resulting in remote code execution. Due to the lack of a nonce for Editors, they are unable to exploit this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress CMP – Coming Soon & Maintenance Plugin by NiteoThemesto a version that resolves this vulnerability.Fixed in 4.1.16 - Configuration
Modify the plugin’s `cmp_theme_update_install` AJAX handler to verify `manage_options` (Administrators only) rather than only `publish_pages` (Editors and above).
CMP – Coming Soon & Maintenance Plugin by NiteoThemes Authorization check for cmp_theme_update_install = Require manage_options instead of publish_pages (Editors+ cannot exploit) - Configuration
In the `cmp_theme_update_install` AJAX flow, validate the user-supplied file URL and verify the downloaded file’s content before extraction to prevent arbitrary file upload / extraction of a malicious ZIP into `wp-content/plugins/cmp-premium-themes/`.
CMP – Coming Soon & Maintenance Plugin by NiteoThemes User-supplied file URL validation and ZIP extraction validation = Add proper validation and verify downloaded file content before extraction - Compensating control
Restrict or limit authenticated access to the WordPress admin area so only trusted Administrators can access/trigger the `cmp_theme_update_install` AJAX action (reduce risk of Administrator+/authenticated attackers forcing remote ZIP download/extraction).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6518?
CVE-2026-6518 is considered a high severity vulnerability due to its potential for arbitrary file upload and remote code execution.
How do I fix CVE-2026-6518?
To fix CVE-2026-6518, update the CMP – Coming Soon & Maintenance Plugin by NiteoThemes to version 4.1.17 or later.
Who is affected by CVE-2026-6518?
CVE-2026-6518 affects users of the CMP – Coming Soon & Maintenance Plugin by NiteoThemes version 4.1.16 and below.
What type of vulnerability is CVE-2026-6518?
CVE-2026-6518 is a missing authorization vulnerability that allows authenticated users to upload arbitrary files.
What could an attacker achieve using CVE-2026-6518?
An attacker could exploit CVE-2026-6518 to execute remote code on the affected WordPress site.