The WP plugin CMP – Coming Soon & Maintenance is vulnerable to an arbitrary file upload that can lead to remote code execution. The flaw resides in the AJAX action that accepts a user‑supplied URL without validating its content or file type. When invoked, the plugin downloads a ZIP archive from the attacker’s URL, extracts it into a web‑accessible directory, and executes any PHP code it contains. This functionality is guarded only by a `publish_pages` capability check, which grants access to Editors and higher roles, thus enabling attackers with Administrator privileges to upload malicious payloads. The weakness is a classic insecure file upload flaw (CWE‑434) where the server fails to restrict input and verify the integrity of the downloaded content.

WordPress sites running the CMP – Coming Soon & Maintenance plugin from NiteoThemes version 4.1.16 or earlier are affected. The only affected component is the plugin itself; the vulnerability does not require modification of core WordPress files. All installations of the plugin, regardless of site size, that have not upgraded past 4.1.16 are at risk.

The CVSS score of 8.8 indicates high severity, with potential to gain arbitrary code execution on the web server. Because the exploitation requires authenticated access with Administrative privileges, the attack surface is limited to users who have already compromised or legitimately possess such roles. The EPSS score is not available, so an assessment of real‑world exploitation probability cannot be provided. The vulnerability is not listed in the CISA KEV catalog, but the combination of a high CVSS score and vulnerable code paths suggests the risk is significant for any site that has not applied the latest fix. Attackers would typically deliver a malicious ZIP via the AJAX endpoint, triggering the download and extraction, which then results in a RCE in the web root. No nonce requirement for Editors blocks lower‑privileged users from executing the exploit. The path to exploitation is publicly documented in the source references. Therefore, sites should treat this as a high‑priority issue.