VulnSocial

CVE-2026-6518Disclosure

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to arbitrary file upload and remote code execution in all versions up to, and including, 4.1.16 via the `cmp_theme_update_install` AJAX action. This is due to the function only checking for the `publish_pages` capability (available to Editors and above) instead of `manage_options` (Administrators only), combined with a lack of proper validation on the user-supplied file URL and no verification of the downloaded file's content before extraction. This makes it possible for authenticated attackers, with Administrator-level access and above, to force the server to download and extract a malicious ZIP file from a remote attacker-controlled URL into a web-accessible directory (`wp-content/plugins/cmp-premium-themes/`), resulting in remote code execution. Due to the lack of a nonce for Editors, they are unable to exploit this vulnerability.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-434

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 4 signals
  • Disclosure: 4 classified signals
  • Peaked 1d ago at 3 mentions (2026-04-18); latest day: 1
  • 4 total mentions across 2 days

Deep dive

Activity timeline4 mentions / 2d
01223Mentions · 2026-04-18: 3Mentions · 2026-04-19: 1Technical Details · 2026-04-18: 3Technical Details · 2026-04-19: 104-1804-19
Signal classification1 categories
Disclosure
4100.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-04-183
Disclosure3
2026-04-191
Disclosure1
Full discourse4 posts
  • ThreatCluster@threatcluster
    Disclosure

    BREAKING: Critical RCE CVE-2026-6518 hits CMP Coming Soon & Maintenance WordPress plugin versions up to 4.1.16, enabling admin-level arbitrary file upload, no patch available. https://threatcluster.io/cluster/critical-rce-vulnerability-in-wordpress-plugin-cve-2026-6518-09ad35ab

    Post summary

    This tweet announces the discovery of CVE‑2026‑6518, a critical RCE in the CMP Coming Soon & Maintenance WordPress plugin that enables arbitrary file uploads, with no patch available.

    00010105
    160 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-6518 The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to arbitrary file upload and remote code execution in all versions up to, a… https://www.cve.org/CVERecord?id=CVE-2026-6518

    Post summary

    The text discloses that the WordPress CMP – Coming Soon & Maintenance Plugin is vulnerable to arbitrary file upload and remote code execution, identified as CVE-2026-6518.

    0000063
    57.2K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-6518 Arbitrary File Upload and Remote Code Execution in CMP Plugin WordPress Versions Up to 4.1.16 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-6518

    Post summary

    The excerpt announces CVE‑2026‑6518, describing a file‑upload vulnerability that allows remote code execution in CMP Plugin versions up to 4.1.16, accompanied by a link to a vulnerability details page.

    0000045
    4.0K followersView on X
  • Kaitan ID Security@KaitanSecurity
    Disclosure

    ⚠️ HIGH — CVE-2026-6518 The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to arbitrary file upload a… CVSS 8.8 Full analysis → https://sec.kaitan.id/cves/CVE-2026-6518 #WordPress #CyberSecurity #InfoSec

    Post summary

    A high‑severity flaw (CVE‑2026‑6518) is disclosed in the CMP Coming Soon & Maintenance plugin for WordPress, enabling arbitrary file upload with a CVSS score of 8.8, but no PoC, exploit, or patch information is provided.

    000004
    124 followersView on X

Explore more

Back to dashboard