The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to arbitrary file upload and remote code execution in all versions up to, and including, 4.1.16 via the `cmp_theme_update_install` AJAX action. This is due to the function only checking for the `publish_pages` capability (available to Editors and above) instead of `manage_options` (Administrators only), combined with a lack of proper validation on the user-supplied file URL and no verification of the downloaded file's content before extraction. This makes it possible for authenticated attackers, with Administrator-level access and above, to force the server to download and extract a malicious ZIP file from a remote attacker-controlled URL into a web-accessible directory (`wp-content/plugins/cmp-premium-themes/`), resulting in remote code execution. Due to the lack of a nonce for Editors, they are unable to exploit this vulnerability.
CVE-2026-6518 is a high-severity vulnerability in the CMP – Coming Soon & Maintenance Plugin by NiteoThemes for WordPress. The vulnerability stems from improper capability checks and insufficient validation of user-supplied file URLs in the cmp_theme_update_install AJAX action. Specifically, the function checks for the publish_pages capability instead of the more restrictive manage_options capability, allowing users with Administrator privileges to trigger the download and extraction of attacker-controlled ZIP files into a web-accessible plugin directory. This leads to remote code execution on the affected server. Editors cannot exploit this due to missing nonce protection. The vulnerability affects all plugin versions up to 4.1.16. No patch or official fix has been published as of the provided data.
Successful exploitation allows an authenticated user with Administrator privileges to upload and execute arbitrary code on the affected WordPress server by forcing it to download and extract malicious files into a web-accessible directory. This can lead to full compromise of the web server, including confidentiality, integrity, and availability impacts. Editors cannot exploit this vulnerability due to nonce protections. There are no known exploits in the wild at this time.
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator access to trusted users only and monitor for suspicious activity related to the cmp_theme_update_install AJAX action. Avoid using the vulnerable plugin versions if possible.
The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to arbitrary file upload and remote code execution in all versions up to, and including, 4.1.16 via the `cmp_theme_update_install` AJAX action. This is due to the function only checking for the `publish_pages` capability (available to Editors and above) instead of `manage_options` (Administrators only), combined with a lack of proper validation on the user-supplied file URL and no verification of the downloaded file's content before extraction. This makes it possible for authenticated attackers, with Administrator-level access and above, to force the server to download and extract a malicious ZIP file from a remote attacker-controlled URL into a web-accessible directory (`wp-content/plugins/cmp-premium-themes/`), resulting in remote code execution. Due to the lack of a nonce for Editors, they are unable to exploit this vulnerability.
Machine-generated threat intelligence
CVE-2026-6518 is a high-severity vulnerability in the CMP – Coming Soon & Maintenance Plugin by NiteoThemes for WordPress. The vulnerability stems from improper capability checks and insufficient validation of user-supplied file URLs in the cmp_theme_update_install AJAX action. Specifically, the function checks for the publish_pages capability instead of the more restrictive manage_options capability, allowing users with Administrator privileges to trigger the download and extraction of attacker-controlled ZIP files into a web-accessible plugin directory. This leads to remote code execution on the affected server. Editors cannot exploit this due to missing nonce protection. The vulnerability affects all plugin versions up to 4.1.16. No patch or official fix has been published as of the provided data.
Successful exploitation allows an authenticated user with Administrator privileges to upload and execute arbitrary code on the affected WordPress server by forcing it to download and extract malicious files into a web-accessible directory. This can lead to full compromise of the web server, including confidentiality, integrity, and availability impacts. Editors cannot exploit this vulnerability due to nonce protections. There are no known exploits in the wild at this time.
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator access to trusted users only and monitor for suspicious activity related to the cmp_theme_update_install AJAX action. Avoid using the vulnerable plugin versions if possible.
Threat ID: 69e30ab8bdfbbecc59e84c33
Added to database: 4/18/2026, 4:38:16 AM
Last enriched: 4/18/2026, 4:53:06 AM
Last updated: 4/19/2026, 6:14:46 AM
Crowdsource mitigation strategies, intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Instant breach scanning across billions of leaked records. Free tier available.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
