Attack Chain

1. Attacker obtains valid credentials for an account with Editor-level permissions on the target WordPress site.
2. Attacker authenticates to the WordPress dashboard using the compromised credentials.
3. Attacker identifies that the CMP plugin is installed and active on the site.
4. Attacker crafts a malicious HTTP POST request targeting the 'admin-ajax.php' endpoint with the 'cmp_ajax_import_settings' action.
5. The request body includes JSON-encoded payload values designed to modify core 'wp_options' table entries.
6. The plugin processes the request without validating the user's capability, updating the site settings to enable 'users_can_register' and setting the 'default_role' to 'administrator'.
7. Attacker navigates to the public registration page to create a new user account, which is automatically assigned the administrator role upon creation.
8. Attacker logs in with the newly created administrator account to achieve full site takeover.

Impact

Successful exploitation of CVE-2026-12470 results in total compromise of the affected WordPress site. An attacker can gain administrative access, potentially leading to the installation of malicious plugins, backdoored themes, data exfiltration, or the defacement of the website. Any site running the CMP plugin up to version 4.1.17 is considered at high risk of unauthorized administrative account creation.

Recommendation

Prioritize the immediate update of the CMP - Coming Soon & Maintenance Plugin to a patched version beyond 4.1.17 as provided by NiteoThemes.

For security operations teams:

• Monitor 'wp-admin/admin-ajax.php' access logs for POST requests containing 'cmp_ajax_import_settings' that originate from non-administrative accounts.
• Audit the 'wp_options' table for sudden changes to the 'default_role' and 'users_can_register' keys.
• Review all administrative accounts created recently to ensure they are legitimate.