CVE-2026-13415

Name of the Vulnerable Software and Affected Versions CMP WordPress plugin versions prior to 4.1.18

Description The plugin fails to enforce an option-name allow-list during the import of settings via an AJAX action. This allows users with the Editor role, provided they have been granted access to the plugin's admin-bar controls, to update arbitrary WordPress options. This flaw can be leveraged to achieve privilege escalation to the Administrator role.

Recommendations Update the CMP WordPress plugin to version 4.1.18 or later.