CVE-2026-12470 in CMP Coming Soon & Maintenance Plugin
Summary
by MITRE • 09/22/2026
The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'cmp_ajax_import_settings' AJAX action in all versions up to, and including, 4.1.17. This makes it possible for authenticated attackers, with Editor-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in the CMP – Coming Soon & Maintenance Plugin by NiteoThemes, specifically affecting versions up through 4.1.17, represents a critical security flaw rooted in insufficient authorization controls within the plugin's AJAX handling mechanisms. The core technical issue lies in the absence of a proper capability check on the 'cmp_ajax_import_settings' action endpoint. In WordPress development standards, any function exposed via an AJAX request must verify that the initiating user possesses the necessary permissions to perform the requested operation. This specific implementation fails to validate whether the authenticated user has administrative privileges before allowing them to modify critical site configuration options. Consequently, this oversight creates a direct pathway for privilege escalation, transforming what might initially appear as a minor data manipulation issue into a severe compromise of system integrity and access control.
From an operational perspective, the impact of this vulnerability is significant because it allows authenticated attackers with Editor-level access or higher to alter arbitrary WordPress site options. While Editor-level users are generally restricted from changing high-level administrative settings such as user registration policies or default role assignments, this flaw bypasses those restrictions entirely. An attacker can exploit this by sending a crafted AJAX request that updates the 'default_role' option to administrator and simultaneously enables public user registration through the 'users_can_register' setting. This combination of changes effectively lowers the barrier for entry into the WordPress installation. Once these settings are modified, an attacker or any subsequent malicious actor can register new accounts with full administrative privileges without needing prior knowledge of existing admin credentials.
This vulnerability aligns closely with CWE-269, which describes Improper Privilege Management, as it involves a failure to enforce proper access control levels for privileged actions. Furthermore, the exploitation technique maps directly to MITRE ATT&CK tactic T1078, specifically Valid Accounts and potentially T1136 if used in conjunction with creating new accounts, facilitating lateral movement or persistent unauthorized access within the web application environment. The ability to escalate privileges from an Editor role to Administrator is particularly dangerous because Editors are common roles assigned to content managers who may not be security-conscious, thereby increasing the attack surface for organizations relying on this plugin for their maintenance mode needs.
Mitigation strategies must prioritize immediate remediation of the affected software version. Site administrators should update the CMP – Coming Soon & Maintenance Plugin to a version later than 4.1.17 where the developer has implemented proper capability checks, such as verifying current_user_can('manage_options') or similar administrative capabilities before processing import settings requests. In cases where immediate updating is not feasible due to deployment constraints, temporary workarounds include restricting Editor-level access if possible, disabling AJAX endpoints that are not strictly necessary for daily operations through server-side configuration rules like .htaccess directives, and closely monitoring user registration logs for suspicious activity indicating exploitation attempts. Regular security audits of custom plugins and adherence to secure coding practices that mandate explicit permission verification for all state-changing API calls are essential preventive measures against similar vulnerabilities in the future.