The CMP – Coming Soon & Maintenance Plugin for WordPress contains a critical vulnerability allowing authenticated users with Editor-level access to achieve remote code execution.

This flaw exists in the cmp_theme_update_install AJAX action, which fails to properly validate the origin of uploaded ZIP files and incorrectly restricts access to the publish_pages capability. While the vulnerability requires authentication, it allows an attacker to upload and extract malicious files into the server directory to achieve remote code execution.

Successful exploitation of this vulnerability grants an attacker full control over the affected WordPress instance. With the ability to execute arbitrary code on the server, an attacker can steal sensitive database information, modify website content, or use the compromised server as a pivot point for further attacks on the internal network. Given the CVSS score of 8.8, this represents a high-severity risk to system integrity and confidentiality.

Immediate Action: Update the CMP – Coming Soon & Maintenance Plugin to version 4.1.17 or the latest available version provided by NiteoThemes.

Proactive Monitoring: Review server access logs and WordPress activity logs for suspicious AJAX requests or unusual file creation events within the wp-content/plugins/cmp-premium-themes/ directory.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized or suspicious attempts to access the cmp_theme_update_install AJAX endpoint.

Public Exploit Available: Unknown

The vulnerability poses a severe risk to WordPress environments that utilize the CMP plugin. Administrators should prioritize updating the plugin immediately to version 4.1.17 to close the arbitrary file upload vector. Failure to patch may result in total system compromise, and immediate verification of plugin versions across the production environment is strongly advised.