Security Alert Summary
The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions. This can allow authenticated users with the Editor role (if the administrator has granted them access to the plugin’s admin-bar controls) to update arbitrary WordPress options, potentially leading to privilege escalation to Administrator.
CVE Details
- CVE ID:
CVE-2026-13415 - Affected component: CMP WordPress plugin
- Affected versions: Versions before 4.1.18 (as stated in the advisory)
- Published: August 27, 2026 at 6:16:55 AM UTC
- Last modified: August 27, 2026 at 6:16:55 AM UTC
- CVSS v3.1: Not provided in the available data
- Authentication/Privileges/User Interaction:
- Authentication: Required (authenticated user)
- Privileges required: Editor role, and the administrator must have granted Editor access to the CMP plugin admin-bar controls
- User interaction: The issue is triggered via an AJAX import action; no external user interaction beyond performing the action is indicated
- Primary impact:
- Confidentiality: Possible disclosure risk depending on which options are modified
- Integrity: Allows arbitrary WordPress option updates and may lead to privilege escalation to Administrator
- Availability: No specific availability impact described in the advisory
- CWE / weakness ID: Not specified
Technical Details
The vulnerability exists because the plugin does not enforce an allow-list of option names when importing settings via one of its AJAX actions. Without an option-name allow-list or similar validation, the import mechanism can be used to write arbitrary entries to the WordPress options table.
The advisory specifically notes the missing option-name allow-list on the AJAX import action as the root cause. Because the flaw is in the import path, any authenticated user who can trigger that AJAX action and who has been given access to the plugin’s admin-bar controls can supply option keys and values that the plugin will accept and store.
Impact is limited to the ability to modify WordPress options. Some options control user capabilities or plugin behavior; modifying those options could lead to elevation of privilege to Administrator. The advisory does not name specific functions or endpoints beyond referring to the relevant AJAX action, and no exploit or proof-of-concept details are provided in the available data.
How This Could Impact Your Website
Imagine a site with three types of users: the site owner (Administrator), internal staff who are Editors, and an external contractor who is also assigned the Editor role to manage content. If the Administrator has enabled CMP plugin admin-bar controls for Editors, an Editor or contractor could use the plugin’s import action to modify arbitrary options. Depending on which options are changed, this may permit escalation to Administrator or change settings that expose internal information.
Practical consequences include exposure of internal user email addresses if options controlling user lists or display are changed, and an increased risk of targeted phishing or social engineering if role or capability options are altered. Changes to plugin or site options could also disrupt workflows or editorial controls.
professional review If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capabilities, especially limiting Editor access to admin-bar plugin controls.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce the attack surface.
- Monitor site activity and logs for unusual behavior, such as unexpected option changes or privilege escalations.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
