CVE-2026-13415

Katalog CVE

CVSS 7.2 · High EPSS 0,25%

Kerentanan Improper Privilege Management. Skor CVSS 3.1 7.2 (High) menurut CISA ADP.

Deskripsi (NVD)

The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls) to update arbitrary WordPress options, including options that lead to privilege escalation to Administrator.

Rincian

Terbit di NVD

27 Agustus 2026

Terakhir diubah

28 Agustus 2026

Status NVD

Deferred

CVSS 3.1

7.2 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-269: Improper Privilege Management

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 15,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://wpscan.com/vulnerability/f0380d89-6e49-462a-b158-9d2cc3f049ca/