WordPress Plugin Missing Capability Check Enables Privilege Escalation

The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'cmp_ajax_import_settings' AJAX action in all versions up to, and including, 4.1.17. This makes it possible for authenticated attackers, with Editor-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The CMP – Coming Soon & Maintenance Plugin for WordPress contains a critical authorization bypass vulnerability in its AJAX handler that fails to validate user capabilities before processing settings imports. Authenticated users with Editor-level access or higher can exploit the 'cmp_ajax_import_settings' action to modify arbitrary WordPress options without proper permission checks. This vulnerability matters because it allows low-privileged attackers to escalate their access by manipulating site configuration—particularly by changing the default user role for new registrations to Administrator. Any WordPress site running the affected plugin versions up to 4.1.17 with Editor-level users is at risk, making this a significant threat to multi-user WordPress installations.

Casky's 224 mapped skills detect this vulnerability pattern by correlating MITRE ATT&CK technique TA0004 (Privilege Escalation) with CWE-269 (Improper Access Control) indicators. Practitioners using Casky would identify attack signatures including: unauthorized AJAX endpoint invocations from low-privileged sessions, suspicious wp_options table modifications outside expected administrative workflows, unexpected role assignments during user registration processes, and capability checks that fail silently or bypass role validation. Claude AI's extended reasoning analyzes these behavioral patterns to distinguish legitimate configuration changes from exploitation attempts, surfacing findings such as Editor accounts triggering administrative-level option updates, batch option modifications through AJAX without nonce validation, and rapid role escalation following settings imports—all indicative of this specific privilege escalation chain.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-12470.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-12470

Casky has 224 skills that investigate the attack patterns behind CVE-2026-12470. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn