CVE-2026-12470
Received Received - Intake

Privilege Escalation in CMP WordPress Plugin

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: Wordfence

Description
The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'cmp_ajax_import_settings' AJAX action in all versions up to, and including, 4.1.17. This makes it possible for authenticated attackers, with Editor-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-12470
EUVD
EUVD-2026-84273

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
niteothemes cmp_coming_soon_and_maintenance_plugin to 4.1.17 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the CMP – Coming Soon & Maintenance Plugin for WordPress. It allows authenticated attackers with Editor-level access or higher to modify WordPress site settings via a missing capability check on the 'cmp_ajax_import_settings' AJAX action. Attackers can update arbitrary options, including changing the default user role to administrator and enabling user registration, which could grant them full administrative access to the site.

Detection Guidance

Check WordPress sites using the CMP plugin for unauthorized option updates. Inspect AJAX calls to 'cmp_ajax_import_settings' and review user registration settings. Look for unexpected changes to default admin roles or enabled user registration.

Impact Analysis

If you use this plugin, an attacker could gain full administrative control of your WordPress site. This could lead to complete site takeover, data theft, defacement, or installation of malicious code. The impact is significant as it requires only Editor-level access to exploit, making it easier for attackers to escalate privileges.

Compliance Impact

This vulnerability could lead to unauthorized access and modification of sensitive data, violating GDPR and HIPAA requirements for data protection and access control. A breach could result in legal penalties, loss of trust, and failure to meet compliance standards due to unauthorized administrative access.

Mitigation Strategies

Update the CMP plugin to the latest version if available. If not, disable the plugin immediately. Review and restrict Editor-level user permissions. Disable user registration if not needed and audit site options for unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12470. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart