CVE-2020-36730
CMP <= 3.8.1 - Missing Authorization
CRITICAL 9.3EPSS 2.3%
The CMP for WordPress is vulnerable to authorization bypass due to a missing capability check on the cmp_get_post_detail(), niteo_export_csv(), and cmp_disable_comingsoon_ajax() functions in versions up to, and including, 3.8.1. This makes it possible for unauthenticated attackers to read posts, export subscriber lists, and/or deactivate the plugin.
- Affected
- niteo · CMP – Coming Soon & Maintenance Plugin by NiteoThemes
- CVSS v3.1 NVD
- 9.3 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:H - CVSS v3.1 WORDFENCE
- 8.3 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - EPSS
- 2.27% chance of exploitation in the next 30 days, 83rd percentile
- Published
- 2023-06-07
- Updated
- 2026-04-08
Proof-of-concept exploits (1)
- RandomRobbieBF/CVE-2020-367301★ · 2024-02-23
Security advisories
- https://wpscan.com/vulnerability/10341
- https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-cmp-coming-soon-maintenance…
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f1ef067b-e4b4-4174-b6ff-ec94a7a…