The CMP – Coming Soon & Maintenance Plugin by NiteoThemes (versions up to 4.1.16) contains an arbitrary file upload vulnerability exploitable via the cmp_theme_update_install AJAX action. The plugin incorrectly authorizes users with publish_pages capability instead of manage_options, allowing authenticated Administrators to trigger the server to download and extract attacker-controlled ZIP archives into the wp-content/plugins/cmp-premium-themes/ directory. This lack of proper URL validation and file content verification leads to remote code execution. Editors cannot exploit this due to nonce absence. The vulnerability is tracked as CVE-2026-6518 with a CVSS 3.1 score of 8.8 (high severity). No patch or official remediation has been disclosed yet.

Successful exploitation allows authenticated users with Administrator privileges to execute arbitrary code on the affected server by uploading and extracting malicious files into a web-accessible plugin directory. This can lead to full compromise of the WordPress site and potentially the underlying server. Editors cannot exploit this vulnerability due to nonce protection absence. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator access to trusted users only and consider disabling or removing the affected plugin if possible. Monitor for vendor updates regarding patches or official mitigations.