Privilege Escalation Vulnerability in CMP WordPress Plugin by CMP
CVE-2026-13415
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-13415?
The CMP WordPress plugin prior to version 4.1.18 lacks robust checks on setting imports, specifically failing to enforce an option-name allow-list when settings are imported via AJAX actions. This oversight can enable users with Editor permissions, if granted access by an administrator, to modify any WordPress options—including those that could escalate their privileges to Administrator level. Addressing this vulnerability is critical to maintaining the security integrity of WordPress sites utilizing this plugin.
Affected Version(s)
CMP 0 < 4.1.18
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.