CVE-2026-6518 - Vulnerability Analysis

Overview

NiteoThemes CMP – Coming Soon & Maintenance Plugin for WordPress <= 4.1.16 contains an unrestricted file upload and remote code execution caused by improper capability checks and lack of validation in cmp_theme_update_install AJAX action, letting authenticated administrators execute arbitrary code remotely, exploit requires administrator privileges.

Severity & Score

Impact

Authenticated administrators can execute arbitrary code remotely, potentially leading to full server compromise.

Mitigation

Update to the latest version beyond 4.1.16.

References

• https://plugins.trac.wordpress.org/browser/cmp-coming-soon-maintenance/tags/4.1.16/niteo-cmp.php#L1421
• https://plugins.trac.wordpress.org/browser/cmp-coming-soon-maintenance/tags/4.1.16/niteo-cmp.php#L1437
• https://plugins.trac.wordpress.org/browser/cmp-coming-soon-maintenance/tags/4.1.16/niteo-cmp.php#L1447
• https://plugins.trac.wordpress.org/changeset?old_path=%2Fcmp-coming-soon-maintenance/tags/4.1.16&new_path=%2Fcmp-coming-soon-maintenance/tags/4.1.17
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d6fb275b-dbba-46df-b170-977ef4a84c4c?source=cve

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner