Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-12470

CMP – Coming Soon & Maintenance Plugin by NiteoThemes · privilege escalation

CVSS 3.1 7.2 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-12470

Published

The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'cmp_ajax_import_settings' AJAX action in all versions up to, and including, 4.1.17. This makes it possible for authenticated attackers, with Editor-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-12470

Published

CMP – Coming Soon & Maintenance Plugin by NiteoThemes

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "niteo",
                    "product": "CMP – Coming Soon & Maintenance Plugin by NiteoThemes",
                    "versions": [
                        {
                            "version": "0",
                            "status": "affected",
                            "lessThanOrEqual": "4.1.17",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON