VULNERABILITY INTELLIGENCE

CVE-2026-13415

CVSS score7.2 HIGH
EPSS probability0.46%
CISA KEVNot currently listed
Published2026-08-27
Last modified2026-08-28
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls) to update arbitrary WordPress options, including options that lead to privilege escalation to Administrator.

Weakness classification

  • CWE-269: Improper Privilege Management

Primary references