Security Alert Summary
The CMP – Coming Soon & Maintenance Plugin by NiteoThemes contains an arbitrary file upload vulnerability that can lead to remote code execution. The issue is reachable via the cmp_theme_update_install AJAX action and is caused by insufficient capability checks and lack of validation of a user-supplied file URL and downloaded content. Authenticated users with Administrator-level access and above are able to trigger a download and extraction of a remote ZIP file into a web-accessible directory, potentially allowing execution of attacker-supplied code.
CVE Details
- CVE ID: CVE-2026-6518
- Affected component: CMP – Coming Soon & Maintenance Plugin by NiteoThemes
- Affected versions: All versions up to and including 4.1.16
- Published: April 18, 2026 at 05:16:24 AM
- Last modified: April 18, 2026 at 05:16:24 AM
- CVSS v3.1: Base Score 8.8, Severity HIGH, Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Authentication / Privileges / User Interaction:
- Authentication: Authenticated (attacker must be logged in)
- Privileges Required: Low (PR:L) per CVSS. The vendor description specifies exploitation is possible with Administrator-level access and above; Editors are unable to exploit due to lack of a nonce.
- User Interaction: None (UI:N)
- Primary impact: Confidentiality: High; Integrity: High; Availability: High
- CWE / Weakness: CWE-434 (Unrestricted Upload of File with Dangerous Type)
Technical Details
The vulnerability exists in the handling of the cmp_theme_update_install AJAX action. The implementation only checks for the publish_pages capability instead of the intended manage_options capability, and it fails to validate the user-supplied file URL or verify the contents of the downloaded file before extraction. An authenticated attacker who can meet the required capability can force the server to download a ZIP file from an attacker-controlled URL and extract it into a web-accessible directory (wp-content/plugins/cmp-premium-themes/), which can result in remote code execution if the extracted files contain executable PHP code.
The description notes that Editors are unable to exploit this issue because of a missing nonce, and that exploitation is achievable by users with Administrator-level access and above. The core issues are inadequate capability checking and missing validation/verification of external resources prior to decompressing and installing them on the server.
How This Could Impact Your Website
In a realistic scenario, a site owner maintains a WordPress site with multiple users: an administrator, one or more editors, and external contractors who may have elevated accounts for theme or content work. If an attacker with Administrator-level access to the site uses this vulnerability, they could cause the server to download and extract a malicious plugin or theme into the wp-content/plugins/ area. That could allow the attacker to run arbitrary code on the site, install backdoors, or create files that expose internal data.
Practical consequences include exposure of internal user email addresses and other data stored on the site, and an increased risk of targeted phishing or social engineering against staff and contributors if attacker-controlled files are used to harvest information. The risk profile depends on who holds Administrator-level access on your site and whether untrusted remote URLs could be supplied to administrative actions.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially users with Administrator-level access and contributors with elevated privileges.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and themes from the site.
- Monitor site activity and file system changes for unusual behavior, including unexpected files in
wp-content/plugins/.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/cmp-coming-soon-maintenance/tags/4.1.16/niteo-cmp.php#L1421
- https://plugins.trac.wordpress.org/browser/cmp-coming-soon-maintenance/tags/4.1.16/niteo-cmp.php#L1437
- https://plugins.trac.wordpress.org/browser/cmp-coming-soon-maintenance/tags/4.1.16/niteo-cmp.php#L1447
- https://plugins.trac.wordpress.org/changeset?old_path=%2Fcmp-coming-soon-maintenance/tags/4.1.16&new_path=%2Fcmp-coming-soon-maintenance/tags/4.1.17
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d6fb275b-dbba-46df-b170-977ef4a84c4c?source=cve
