CVE-2020-36730highCWE-862

CVE-2020-36730: falha de alta gravidade em niteo CMP – Coming Soon & Maintenance Plugin…

CMP <= 3.8.1 - Missing Authorization

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar CMP – Coming Soon & Maintenance Plugin by NiteoThemes

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.3epss 2.3%
The CMP for WordPress is vulnerable to authorization bypass due to a missing capability check on the cmp_get_post_detail(), niteo_export_csv(), and cmp_disable_comingsoon_ajax() functions in versions up to, and including, 3.8.1. This makes it possible for unauthenticated attackers to read posts, export subscriber lists, and/or deactivate the plugin.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Produtos afetados
niteo · CMP – Coming Soon & Maintenance Plugin by NiteoThemes
CVEs relacionadas — niteo CMP – Coming Soon & Maintenance Plugin…

No mesmo produto, das mais perigosas para as menos.

CVE-2023-1263MEDIUMCMP – Coming Soon & Maintenance Plugin by NiteoThemes <= 4.1.6 - Information ExposureEPSS 1.4%CVE-2026-6518HIGHCMP – Coming Soon & Maintenance Plugin by NiteoThemes <= 4.1.16 - Missing Authorization to Authenticated (Administrator+) Arbitrary File Upload and Remote Code ExecutionEPSS 0.9%CVE-2023-2159MEDIUMCMP – Coming Soon & Maintenance <= 4.1.7 - Maintenance Mode BypassEPSS 0.8%CVE-2026-12470HIGHCMP <= 4.1.17 - Authenticated (Editor+) Privilege Escalation via Arbitrary Option Update to cmp_ajax_import_settings AJAX ActionEPSS 0.6%