The vulnerability is an unrestricted upload flaw that allows an attacker to place arbitrary files on the WordPress server, including files that can be executed. This flaw can be leveraged to execute code because the plugin accepts files with dangerous types, falling under CWE‑434. Based on the description, it is inferred that the vulnerability is triggered by any user who can interact with the plugin’s upload interface, typically without authentication. The result is that an attacker can gain full control of the affected WordPress installation, impacting confidentiality, integrity, and availability.

The affected product is NiteoThemes CMP – Coming Soon & Maintenance. All released versions up to and including 4.1.14 are vulnerable; newer releases are not affected.

The CVSS score of 9.1 indicates critical severity, while the EPSS score of <1% suggests a very low but non‑zero likelihood of exploitation at the time of analysis. The vulnerability can be triggered by any user who can access the plugin’s upload interface, typically without authentication. Once a malicious file is uploaded, the server will execute it, allowing the attacker to compromise the entire WordPress site. The vulnerability is not listed in the CISA KEV catalog.