CVE-2026-13415 CMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Privilege Escalation via cmp_ajax_import_settings
Editors can escalate to Administrator by importing arbitrary settings if admin-bar access is granted.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-13415?
CVE-2026-13415 is a high-severity vulnerability in Unknown CMP, published on 27 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls) to update arbitrary WordPress options, including options that lead to privilege escalation to Administrator.
Weakness: CWE-269
Which versions are affected by CVE-2026-13415?
How do I fix CVE-2026-13415?
No fix has been published for CVE-2026-13415 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-13415 being exploited?
There is no known exploitation of CVE-2026-13415 in the wild and no public exploit code.
Sources
Also known as GHSA-4753-4c7m-r6px.