Arbitrary File Upload and Remote Code Execution in NiteoThemes Plugin for WordPress

CVE-2026-6518

What is CVE-2026-6518?

The CMP – Coming Soon & Maintenance Plugin by NiteoThemes for WordPress is susceptible to arbitrary file upload and remote code execution vulnerabilities. This flaw arises from inadequate access control where the cmp_theme_update_install AJAX action only checks for publish_pages capability, allowing authenticated users with Administrator-level access to exploit the vulnerability. Attackers can force the server to download a malicious ZIP file from a remote source and extract it into a publicly accessible directory, potentially leading to unauthorized code execution. The lack of a proper nonce for Editors means they cannot exploit this vulnerability, but this highlights serious security oversights that could be leveraged by malicious actors with sufficient privileges.

References