Arbitrary Option Update in CMP WordPress Plugin

Executive Summary

The CMP WordPress plugin before version 4.1.18 has a flaw in its AJAX action handling. It does not restrict which WordPress options can be updated via the cmp_ajax_import_settings function. If an administrator granted Editors access to the plugin's admin-bar controls, an Editor can exploit this to modify arbitrary options, including those granting full admin access.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the installed version of the CMP – Coming Soon & Maintenance plugin. If it is below 4.1.18, the system is vulnerable. Use WordPress admin tools or run a command like 'wp plugin list' in the WordPress directory to verify the plugin version.

Useful 0 Not Useful 0

Impact Analysis

If you are an Editor with access to the plugin's admin-bar controls, an attacker could exploit this to escalate your privileges to Administrator. This could allow unauthorized control over the WordPress site, including installing malicious plugins or modifying site settings.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized privilege escalation. If exploited, it may enable an Editor to gain Administrator access, which could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the CMP – Coming Soon & Maintenance plugin to version 4.1.18 or later. If updating is not possible, restrict Editor role permissions or revoke access to the plugin's admin-bar controls for Editors to prevent privilege escalation.

Useful 0 Not Useful 0