The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls) to update arbitrary WordPress options, including options that lead to privilege escalation to Administrator.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Cmp Coming Soon Maintenance Plugin | — | Update cmp-coming-soon-maintenance plugin to version 4.1.18, or a newer patched version | Oct 30, 2026 | Aug 28, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub