CVE-2026-13415: CMP WordPress Plugin Privilege Escalation

CVE-2026-13415 Overview

CVE-2026-13415 affects the CMP (Coming Soon & Maintenance) WordPress plugin in versions before 4.1.18. The plugin exposes an AJAX action for importing settings that does not enforce an option-name allow-list. Authenticated users with the Editor role can abuse this AJAX endpoint to update arbitrary WordPress options. The issue only surfaces when an administrator has explicitly granted the Editor role access to the CMP plugin's admin-bar controls. Because arbitrary options can be overwritten, an Editor can escalate privileges to Administrator.

Critical Impact
An authenticated Editor can update arbitrary WordPress options through an unrestricted AJAX import action and elevate to Administrator on affected sites.

Affected Products

CMP WordPress plugin versions prior to 4.1.18
WordPress installations that grant Editor role users access to CMP admin-bar controls
Sites running the plugin with the vulnerable AJAX settings import handler

Discovery Timeline

2026-08-27 - CVE-2026-13415 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-13415

Vulnerability Analysis

The CMP WordPress plugin exposes an AJAX action for importing plugin settings. The handler iterates over caller-supplied option names and passes them directly to update_option() without validating the option name against an allow-list of plugin-owned options. WordPress does not restrict update_option() to specific keys, so the handler can write to any option in the wp_options table. This is a broken access control issue combined with missing input validation on privileged writes.

The endpoint is gated by capability checks that assume only trusted administrators reach the handler. However, when the administrator delegates CMP admin-bar controls to the Editor role, Editors gain access to the same AJAX action. The result is a vertical privilege escalation from Editor to Administrator through option tampering.

Root Cause

The root cause is missing option-name validation on a privileged AJAX handler. The handler treats the entire settings payload as trusted and does not compare each key against a hardcoded list of plugin settings. Any additional keys sent by the caller are written to wp_options alongside legitimate ones.

Attack Vector

An authenticated Editor on a site that has granted the Editor role CMP admin-bar access sends a crafted AJAX request to the settings import action. The attacker includes WordPress core option keys such as default_role (set to administrator) or users_can_register (set to 1), then registers a new account that inherits Administrator privileges. Alternatively, the attacker overwrites options that influence template rendering or active plugins to achieve code execution paths. Refer to the WPScan Vulnerability Report for further technical detail.

Detection Methods for CVE-2026-13415

Indicators of Compromise

Unexpected changes to default_role, users_can_register, siteurl, home, or active_plugins in the wp_options table.
New Administrator accounts created shortly after an Editor session.
POST requests to /wp-admin/admin-ajax.php referencing the CMP settings import action from Editor accounts.
Modifications to wp_usermeta capability entries promoting non-admin users.

Detection Strategies

Audit the wp_options table for changes to security-relevant keys and correlate with the acting user session.
Inspect web server access logs for AJAX calls to the CMP import endpoint originating from Editor-level session cookies.
Compare current CMP plugin version against 4.1.18 across all managed WordPress sites.

Monitoring Recommendations

Alert on WordPress option changes to default_role and users_can_register outside of change windows.
Track privilege promotion events where a user gains the administrator role.
Monitor plugin AJAX endpoints for calls made by roles other than Administrator.

How to Mitigate CVE-2026-13415

Immediate Actions Required

Update the CMP WordPress plugin to version 4.1.18 or later on every affected site.
Revoke Editor role access to CMP admin-bar controls until patching is complete.
Review wp_options and user role assignments for signs of tampering.
Rotate credentials for all Administrator accounts on impacted sites.

Patch Information

The vendor addressed the issue in CMP version 4.1.18 by enforcing an allow-list of plugin-owned option names in the settings import AJAX handler. See the WPScan Vulnerability Report for advisory details.

Workarounds

Do not grant the Editor role access to CMP admin-bar controls until the plugin is updated.
Restrict the CMP settings import AJAX action via a web application firewall rule that blocks non-Administrator callers.
Temporarily deactivate the CMP plugin on sites where an update cannot be applied immediately.

bash

# Configuration example: verify plugin version via WP-CLI
wp plugin get cmp --field=version
wp plugin update cmp --version=4.1.18