Privilege Escalation in CMP - Coming Soon & Maintenance Plugin for WordPress

The CMP - Coming Soon & Maintenance Plugin by NiteoThemes for WordPress is susceptible to an unauthenticated privilege escalation vulnerability tracked as CVE-2026-12470. The vulnerability exists within the 'cmp_ajax_import_settings' AJAX action, which fails to perform necessary capability checks before processing user-supplied data. This allows an authenticated user with Editor-level access or higher to perform unauthorized modifications to the WordPress site's configuration. By manipulating global options, such as the default user role and registration settings, an attacker can elevate their own privileges or create new administrative accounts, ultimately gaining full control over the affected WordPress installation. This issue impacts all plugin versions up to and including 4.1.17.

Attack Chain

1. Attacker obtains valid credentials for an account with Editor-level permissions on the target WordPress site.
2. Attacker authenticates to the WordPress dashboard using the compromised credentials.
3. Attacker identifies that the CMP plugin is installed and active on the site.
4. Attacker crafts a malicious HTTP POST request targeting the 'admin-ajax.php' endpoint with the 'cmp_ajax_import_settings' action.
5. The request body includes JSON-encoded payload values designed to modify core 'wp_options' table entries.
6. The plugin processes the request without validating the user's capability, updating the site settings to enable 'users_can_register' and setting the 'default_role' to 'administrator'.
7. Attacker navigates to the public registration page to create a new user account, which is automatically assigned the administrator role upon creation.
8. Attacker logs in with the newly created administrator account to achieve full site takeover.

Impact

Successful exploitation of CVE-2026-12470 results in total compromise of the affected WordPress site. An attacker can gain administrative access, potentially leading to the installation of malicious plugins, backdoored themes, data exfiltration, or the defacement of the website. Any site running the CMP plugin up to version 4.1.17 is considered at high risk of unauthorized administrative account creation.

Recommendation

Prioritize the immediate update of the CMP - Coming Soon & Maintenance Plugin to a patched version beyond 4.1.17 as provided by NiteoThemes.

For security operations teams:

• Monitor 'wp-admin/admin-ajax.php' access logs for POST requests containing 'cmp_ajax_import_settings' that originate from non-administrative accounts.
• Audit the 'wp_options' table for sudden changes to the 'default_role' and 'users_can_register' keys.
• Review all administrative accounts created recently to ensure they are legitimate.