CVE-2026-13415
High
Description
The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls) to update arbitrary WordPress options, including options that lead to privilege escalation to Administrator.
SeverityHigh
CVSS7.2
Exploit probability—
ProductCMP
PublishedAug 27, 2026
First seenAug 27, 2026
Weakness typeCWE-269Improper privilege management
How to fix
Update
- CMP4.1.18 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| CMP | v < 4.1.18 | 4.1.18 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.