The vulnerability CVE-2025-32118 affects the NiteoThemes CMP – Coming Soon & Maintenance WordPress plugin up to version 4.1.14. It permits users with high privileges to upload files without proper restrictions on file types, potentially allowing malicious files to be uploaded. This can result in severe impacts including full system compromise. The CVSS v3.1 base score is 9.1, reflecting critical severity with network attack vector, low attack complexity, required high privileges, no user interaction, and complete impact on confidentiality, integrity, and availability.

An attacker with high privileges can upload malicious files due to lack of file type restrictions. This can lead to full system compromise, including unauthorized access, data modification, and service disruption. The vulnerability is rated critical with a CVSS score of 9.1, indicating a severe impact on affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's upload functionality to trusted administrators only and monitor for suspicious activity related to file uploads.