A critical privilege escalation vulnerability in the CMP WordPress plugin allows authenticated users with Editor roles to gain full administrative control over the affected site.

The vulnerability is an improper privilege management flaw (CWE-269) within the plugin's AJAX settings import functionality. An attacker with the Editor role can manipulate the import process to modify sensitive WordPress options, effectively granting themselves unauthorized administrative privileges.

Successful exploitation of this vulnerability results in full administrative compromise of the WordPress environment. Given the CVSS score of 7.2, this represents a significant risk to data integrity and system availability, as an attacker can modify global settings, install malicious plugins, or exfiltrate sensitive site data.

Immediate Action: Update the CMP plugin to version 4.1.18 or later immediately to implement the required option-name allow-list validation.

Proactive Monitoring: Review WordPress administrative user logs for unexpected account creation or unauthorized modifications to site settings.

Compensating Controls: If an immediate update is not possible, restrict access to the affected plugin's administrative bar controls for all non-administrator roles.

Public Exploit Available: Unknown

Organizations utilizing the CMP WordPress plugin must prioritize upgrading to version 4.1.18. This update is essential to prevent privilege escalation attacks that could lead to a total compromise of the WordPress application. Administrators should also perform an audit of current user permissions to ensure that elevated plugin access is granted only to trusted personnel.