CVE-2020-36730

Name of the Vulnerable Software and Affected Versions CMP for WordPress versions up to, and including, 3.8.1

Description The issue is related to a missing capability check on the cmp get post detail(), niteo export csv(), and cmp disable comingsoon ajax() functions. This allows unauthenticated attackers to read posts, export subscriber lists, and/or deactivate the plugin.

Recommendations For versions up to, and including, 3.8.1, update to a version that includes a fix for the missing capability check on the cmp get post detail(), niteo export csv(), and cmp disable comingsoon ajax() functions. As a temporary workaround, consider disabling the cmp get post detail(), niteo export csv(), and cmp disable comingsoon ajax() functions until a patch is available.