CVE-2026-13415

CMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Privilege Escalation via cmp_ajax_import_settings

The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls) to update arbitrary WordPress options, including options that lead to privilege escalation to Administrator.

We have discovered 672 live websites that are affected by CVE-2026-13415.

Run a Free Instant Scan



Affected Software

Product  Cmp Coming Soon Maintenance
Category Wordpress Plugins
Vulnerable Domains672 live websites (100% of Cmp Coming Soon Maintenance install base)
Vulnerable Versions
  • from 0 through 4.1.18
Vulnerable Versions Count27 versions ( 100% of all versions)


Common Weakness Enumeration

CWE-269 Improper Privilege Management



Details

  • Published - Aug 27, 2026
  • Updated - Aug 27, 2026

Credits

  • Revanth Hari Narayana Matte (finder)
  • WPScan (coordinator)

Website Distribution by Country

Number of websites using CVE-2026-13415
United States142 websites


Germany74 websites
GB49 websites
Italy49 websites
Russia47 websites
South Africa34 websites
Netherlands31 websites
France26 websites
Australia17 websites
Spain15 websites

Website Distribution by TLD

Number of websites using CVE-2026-13415
.com244 websites
.ru44 websites
.de38 websites
.it37 websites
.nl27 websites
.co.uk23 websites
.org23 websites
.fr13 websites
.net11 websites
.ch11 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-13415

Top websites that are affected by CVE-2026-13415. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
********************.com United States**,***
*********.***.ar Argentina***,***
************.com United States***,***
*********.com United States*,***,***
****.it Italy*,***,***
*************.de Germany*,***,***
*****************.com United States*,***,***
*****************.***.uk GB*,***,***
***.**********.ru Russia*,***,***
**********.***.br Brazil*,***,***
See full domain list

FAQ

CVE-2026-13415 is Improper Privilege Management in Cmp Coming Soon Maintenance
A total of 672 websites have been identified as vulnerable to CVE-2026-13415, based on global website indexing conducted by WebTechSurvey.
The Cmp Coming Soon Maintenance is affected by the CVE-2026-13415 vulnerability.
Cmp Coming Soon Maintenance versions up to 4.1.18 are vulnerable to CVE-2026-13415.
CVE-2026-13415 is resolved in version 4.1.18 of Cmp Coming Soon Maintenance.