CMP Plugin Arbitrary WordPress Options Update Vulnerability

The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls) to update arbitrary WordPress options, including options that lead to privilege escalation to Administrator.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-13415 is a privilege escalation vulnerability in the CMP WordPress plugin that allows Editor-role users to modify arbitrary WordPress options through an unsecured AJAX action. The vulnerability stems from missing input validation on option names during the settings import process, enabling attackers to bypass WordPress's normal permission controls. This affects any WordPress installation running CMP plugin versions before 4.1.18 where administrators have granted Editor-role users access to plugin admin-bar controls. The impact is severe because WordPress options control critical system configurations; attackers can leverage this to escalate privileges to Administrator level, gaining complete site control.

Casky's 224 mapped skills leverage Claude's extended reasoning to identify this attack pattern across MITRE ATT&CK's Privilege Escalation (TA0004) techniques. Practitioners using Casky would observe detection patterns aligned with techniques like T1078 (Valid Accounts) and T1548 (Abuse Elevation Control Mechanism), identifying suspicious AJAX calls to CMP's import handlers that modify wp_options records outside normal workflows. The platform's skill set would flag anomalous option updates targeting capability-related settings, user role assignments, or plugin activation parameters—the typical post-exploitation artifacts. By correlating Editor-role activity with unauthorized option modifications and subsequent Administrator capability changes, Casky helps security teams distinguish legitimate plugin configuration from exploitation attempts, enabling rapid response before privilege escalation completes.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-13415.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-13415

Casky has 224 skills that investigate the attack patterns behind CVE-2026-13415. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn