Nom du plugin	CMP – Coming Soon & Maintenance
Type de vulnérabilité	Téléchargement de fichiers arbitraires
Numéro CVE	CVE-2026-6518
Urgence	Faible
Date de publication du CVE	2026-04-19
URL source	CVE-2026-6518

Urgent Security Advisory: Arbitrary File Upload (CVE-2026-6518) in CMP – Coming Soon & Maintenance Plugin (≤ 4.1.16) — What WordPress Site Owners Must Do Now

Auteur: Équipe de sécurité WP-Firewall

Note: This advisory is written by WP-Firewall security researchers and engineers to help WordPress site owners understand, detect, mitigate, and recover from the arbitrary file upload vulnerability affecting the CMP – Coming Soon & Maintenance plugin versions ≤ 4.1.16. If your site runs this plugin, please read the actions below and remediate immediately.

Résumé exécutif

A critical security issue was disclosed for the WordPress plugin “CMP – Coming Soon & Maintenance” affecting versions up to and including 4.1.16. The vulnerability (tracked as CVE-2026-6518) permits an authenticated user with Administrator-level privileges to upload arbitrary files via an insecure endpoint that lacks appropriate authorization and input validation. Because arbitrary file upload can be leveraged to place PHP web shells or other executable files on the server, this vulnerability can lead to full remote code execution (RCE) and site compromise.

Although the entry requires an Administrator account to trigger, the real-world risk is significant — administrator accounts get compromised via phishing, credential reuse, weak passwords, or other plugin flaws. Automated exploit scripts can quickly weaponize this issue across many sites. The plugin author has released version 4.1.17 which contains a fix. If you cannot update immediately, follow the mitigation steps below.

• CVSS score (reported): 7.2 (High)
• CVE : CVE-2026-6518
• Plugin concerné : CMP – Coming Soon & Maintenance — versions ≤ 4.1.16
• Corrigé dans : 4.1.17

---

9. Pourquoi c'est dangereux (langage simple)

At a glance, uploading files seems harmless — administrators upload images, PDFs, and other media all the time. But when a plugin exposes an endpoint that accepts file uploads without properly validating the file type, name, path, or ensuring the uploader has the correct capability checks and a valid nonce, an attacker can supply a malicious file (for example a PHP web shell). If that file is stored where the web server executes PHP, the attacker can run arbitrary PHP code remotely, escalate access, and maintain persistence. This is one of the most common paths to full compromise.

Key attack vectors:

• Uploading a PHP web shell to the uploads directory or another writable directory.
• Replacing/creating core plugin or theme PHP files to gain persistent code execution.
• Pivoting to dump database credentials, create new admin users, exfiltrate data, or launch further attacks from your site.

Even when an exploit requires Admin privileges, an attacker can sometimes escalate to Admin via other vulnerabilities, social engineering, or credential theft. Therefore, treat this issue as urgent.

---

Résumé technique de la vulnérabilité

• Type de vulnérabilité : Arbitrary file upload (missing authorization / missing capability checks).
• Cause première: A plugin endpoint handling uploads did not verify proper authorization or did not properly validate/sanitize uploaded file contents and names. Nonces, capability checks, and MIME/file-type restrictions were insufficient or absent.
• Impact: An authenticated attacker (administrator-level access required) can upload executable files (for example .php) which could be invoked to achieve remote code execution.
• Exploitabilité : High in scenarios where admin credentials are compromised; medium in other situations where an adjacent vulnerability allows privilege escalation.
• Correctif : Upgrade the plugin to version 4.1.17 or later (contains the fix that validates authorization and file handling).

---

Who is at immediate risk?

• Sites running CMP – Coming Soon & Maintenance plugin version 4.1.16 or older.
• Sites where Administrator accounts may be shared, weak, or compromised.
• Environments that allow execution of uploaded PHP files (default WordPress téléchargements is often writable and can execute PHP depending on server configuration).
• Hosting environments without additional perimeter WAF protections or file execution hardening.

---

Actions immédiates (ce qu'il faut faire tout de suite)

1. Update the plugin to 4.1.17 or later
   • This is the only true fix. Log in to WordPress admin and update the plugin immediately.
   • If you manage multiple sites, deploy updates centrally or via your management tooling.
2. Si vous ne pouvez pas mettre à jour immédiatement — appliquez des atténuations temporaires :
   • Deactivate the CMP plugin until you can update.
   • Restrict access to wp-admin to known IP addresses (if possible) using host or server-level controls.
   • Limit administrator access: temporarily remove non-essential administrator accounts and audit existing ones.
   • Enforce password resets and enable two-factor authentication (2FA) for all administrators.
   • Add server rules to prevent execution of PHP files in the uploads directory (examples below).
3. Recherchez les compromis
   • Run a full malware scan (file-level and signature-based scanning).
   • Inspect recent uploads for unknown files (especially .php, .phtml, .php5, .php7, .phar).
   • Check for new users, modified core/plugin files, unexpected scheduled tasks (wp-cron entries), and outbound network calls to uncommon destinations.
4. Rotation des clés et des identifiants
   • Rotate admin passwords and any API keys that could be exposed.
   • Rotation des identifiants de base de données et mise à jour wp-config.php values if a compromise is suspected.
   • Revoke any OAuth tokens or third-party integrations that may be affected.
5. journaux de surveillance
   • Review web server and PHP logs for suspicious POST requests to plugin endpoints, especially multipart/form-data uploads.
   • Look for requests with unusual user agents or from suspicious IPs making repeated upload attempts.

---

Example server hardening (prevent uploaded PHP execution)

Add to the uploads directory (Apache .htaccess):

# Disable script execution in the uploads directory
<IfModule mod_php7.c>
  php_flag engine off
</IfModule>
<IfModule mod_php5.c>
  php_flag engine off
</IfModule>

# Block common executable extensions
<FilesMatch "\.(php|php5|php7|phtml|pl|py|jsp|asp|aspx|sh|cgi)$">
  Order allow,deny
  Deny from all
</FilesMatch>

Pour Nginx :

location ~* /wp-content/uploads/.*\.(php|php5|php7|phtml)$ {
  deny all;
  return 403;
}

Note: If your hosting provider uses PHP-FPM with fastcgi handlers, ensure that uploads directories are not routed to the PHP handler. Consult your hosting support if you’re unsure.

---

Detection: Indicators of Compromise (IoCs)

Search for these indicators immediately:

• Unexpected PHP files in the wp-content/uploads/ directory:

  find wp-content/uploads -type f -iname "*.php" -ls

• Files with suspicious names (random strings or names like wp-cache.php, images.php, upload.php, mu-plugins/*.php).
• Modified plugin or theme files with recent timestamps:

  stat or ls -l --time=ctime

• Unknown admin users created in the last few days.
• WordPress database entries referencing unknown cron jobs or options changed recently.
• Outbound network traffic from the site to unknown domains (check firewall or hosting outbound logs).
• Unexpected scheduled tasks that run as admin:

  wp cron event list --path=/path/to/site

• Web server logs showing POST requests to plugin-specific endpoints, particularly endpoints ending in /upload or similar, or requests with multipart/form-data payloads to plugin AJAX endpoints.

Recherchez des motifs de webshell courants :

• eval(base64_decode(
• preg_replace('/.*/e'
• system($_GET['cmd'] ou passthru($_REQUEST['cmd']
• Suspicious use of assert() ou create_function() in non-core files.

---

Detailed incident response checklist

Step-by-step actions if you suspect exploitation:

1. Isoler
   • If you suspect active exploitation, consider taking the site offline (maintenance mode) or blocking external traffic while you investigate.
   • Inform your hosting provider — they can help isolate or snapshot the environment.
2. Préserver les preuves
   • Create filesystem and database snapshots for forensics.
   • Save webserver logs, PHP-FPM logs, and access logs.
   • Note timestamps for suspicious activity.
3. Analysez et supprimez
   • Use an up-to-date malware scanner to identify suspicious files.
   • Manually inspect and remove any confirmed web shells or backdoors.
   • Be cautious: attackers often drop multiple backdoors with different names and locations.
4. Nettoyage
   • Replace altered core, plugin, and theme files with fresh copies from official sources.
   • If the site is compromised, consider reinstalling WordPress core, themes, and plugins after verifying integrity.
5. Credentials
   • Force password resets for all users, especially administrator accounts.
   • Invalidate sessions (e.g. wp destroy-session or change salts in wp-config.php).
   • Rotate API keys and database credentials if they may have been accessed.
6. Re-audit
   • After cleanup, scan again thoroughly.
   • Surveillez les journaux de près pour détecter toute récurrence.
7. Durcissement post-incident
   • Apply principle of least privilege — limit number of admins.
   • Imposer l'authentification à deux facteurs pour tous les comptes d'administrateur.
   • Regularly audit accounts and installed plugins.
   • Enable automated plugin updates where reasonable, while testing on staging first for critical sites.

---

How a WAF and virtual patching help (what we recommend)

Modern web application firewalls provide both prevention and virtual patching. When a known plugin vulnerability is disclosed, a WAF can:

• Add a targeted rule to block requests that match the exploit’s signature (e.g., specific URI pattern, parameters, or payloads used by exploit scripts).
• Block upload attempts that contain executable content or suspicious file metadata.
• Rate-limit and block repeated failed attempts to access admin endpoints.
• Prevent exploitation even if the vulnerable plugin remains unpatched for a short window.

At WP-Firewall we apply a layered approach:

• Signature-based rules for known exploit patterns.
• Behavioral rules for anomaly detection (unusual file uploads, changes in admin activity, sudden large POST traffic).
• File integrity monitoring and a malware scanner to discover suspicious files that may have been uploaded.
• Virtual patching to protect vulnerable endpoints until a plugin patch is deployed.

Note: Virtual patching is not a substitute for applying the vendor fix — it buys time to update safely and reduces immediate risk.

---

Exemples d'idées de règles WAF (conceptuelles)

Below are conceptual rules a WAF could enforce to mitigate file upload attacks while a plugin patch is pending. These must be tested carefully on production to avoid false positives.

1. Block uploads that attempt to add PHP or other executable extensions:

   • Condition: multipart/form-data POST to plugin upload endpoint AND filename ending in .php, .phtml, .php5, .pl, .py, .exe.
   • Action : Bloquer et enregistrer.

2. Block upload content that contains PHP opening tags:

   • Condition : Le corps de la requête contient <?php ou <?=.
   • Action : Bloquer et enregistrer.

3. Block requests missing a valid nonce header or cookie (if plugin normally sends a nonce):

   • Condition: AJAX POST to specific plugin URL without valid WordPress nonce.
   • Action : Bloquer ou contester.

4. Rate limit administrative endpoints:

   • Condition: More than X POST requests per minute to admin-wp or plugin endpoints from same IP.
   • Action : Ralentir ou bloquer.

These rules should be applied in a defense-in-depth context and tailored for each site.

---

Practical hardening checklist for WordPress administrators

• Update the vulnerable plugin to the latest version immediately (4.1.17+).
• Limit administrators:
  • Audit admin accounts; remove or demote users who don’t need admin rights.
  • Use unique emails for admin accounts.
• Enforce strong passwords and enable multi-factor authentication for all admin accounts.
• Disable file editing via wp-admin by setting définir( 'DISALLOW_FILE_EDIT', vrai ); dans wp-config.php.
• Use least-privilege hosting accounts (separate FTP/SFTP users, SFTP-only).
• Disable unneeded PHP functions (e.g., exec, shell_exec) at the server level where possible.
• Serve the site via HTTPS and enforce HSTS.
• Regular backups and tested restore procedures — keep at least two recent backups stored off-site.
• Implement file execution prevention for uploads folder (as shown above).
• Monitor admin activity and login attempts (plugins or server logs).
• Keep WordPress core, themes, and all plugins updated and remove unused plugins/themes.

---

Recovering from a confirmed compromise: step-by-step

1. Restore from a known-good backup created prior to the compromise if available and verified.
2. Apply plugin update and server hardening measures.
3. Rotate all credentials (WP users, database, FTP/SFTP, control panel).
4. Re-scan the restored site for latent backdoors.
5. Put the site under increased monitoring for at least 30 days.
6. Conduct a root-cause analysis — how did the attacker obtain the ability to upload? Did they use stolen admin credentials, an unrelated plugin vulnerability, or social engineering?
7. Document the incident and add any new mitigations to your operations playbook.

---

For developers: secure file upload best practices

• Utilisez toujours des vérifications de capacité (l'utilisateur actuel peut) and verify nonces for any endpoints that modify data or accept files.
• Restrict uploads to safe file types and check both MIME types and file extensions.
• Sanitize filenames and avoid relying exclusively on extension checks.
• Store uploaded files outside webroot or ensure they cannot be executed by the server.
• Limit file upload size and validate content-length and actual payload size.
• Use randomized, non-obvious filenames and store metadata in the database.
• Validate file content (e.g., confirm images are real images using getimagesize ou imagecreate).
• Keep error messages generic — don’t reveal internal paths or stack traces.

---

How WP-Firewall helps you reduce risk (what we do differently)

As a WordPress security provider, our approach emphasizes practical, fast protections and clear remediation guidance.

Key capabilities we provide:

• Managed Web Application Firewall (WAF) with targeted rules and virtual patching to block exploit attempts for known plugin vulnerabilities.
• Malware scanner with heuristics to find web shells and suspicious uploads.
• Managed mitigation of OWASP Top 10 risks: our rules target common vectors including arbitrary file upload, insecure deserialization, and injection.
• Unlimited bandwidth and scanning of large sites (no surprise cost for crawling).
• Automated alerts and guidance so administrators understand what to do next.
• For paid tiers: automated malware removal, IP blacklist/whitelist features, scheduled security reports, and advanced support.

We design protections to be minimally disruptive and to provide immediate protection when vulnerabilities are disclosed — crucial when an exploit appears in the wild.

---

Sign up for the free plan to quickly protect your site

Titre: Give Your Site Immediate Baseline Protection — Start with WP-Firewall Free Plan

If you’re running WordPress and want to reduce the chance of a compromise while you triage and patch, our free Basic plan is an easy first step. It gives you essential protections including a managed firewall, a full WAF, malware scanning, unlimited bandwidth, and mitigation coverage against OWASP Top 10 risks — everything a small site needs to get started with professional-grade defenses. Sign up for the free plan and gain immediate baseline protection: https://my.wp-firewall.com/buy/wp-firewall-free-plan/

(If you want automatic remediation and faster response options, consider our Standard and Pro tiers which add automated malware removal, IP controls, monthly security reporting, and virtual patching features.)

---

Foire aux questions (FAQ)

Q: If the exploit requires Administrator access, is it still a real risk?

A: Yes. Administrator accounts are often targeted and can be compromised via credential reuse, phishing, other plugin vulnerabilities, or stolen sessions. Attackers frequently chain vulnerabilities: a low-privilege gain can escalate, or credentials can be stolen through other means. Treat any vulnerability that can lead to RCE as high priority.

Q: I updated the plugin — do I still need to do anything else?

A: Yes. Update immediately, then scan your site for signs of compromise using a reliable malware scanner. Rotate passwords, enable 2FA, and review recent uploads and file changes. If you see anything suspicious, follow the incident response checklist above.

Q: If I can’t update, can a firewall completely protect me?

A: A WAF with targeted rules and virtual patching provides effective temporary protection but is not a permanent substitute for updating. Use the WAF while you schedule and test the plugin update to prevent exploitation in the interim.

Q : Les sauvegardes sont-elles suffisantes ?

A: Backups are essential, but you must ensure they are clean and not infected. Also, backups alone don’t prevent an attacker from re-compromising your site after restore unless you fix the root cause and rotate credentials.

---

Remarques finales et meilleures pratiques

• Patch promptly. Upgrades like the plugin’s 4.1.17 release are the long-term fix.
• Maintain the fundamentals: least privilege, 2FA, strong passwords, and routine audits.
• Use layered defenses: server hardening, WAF, malware scanning, backups, and active monitoring.
• Prepare an incident response plan now so your team is ready if the worst happens.

As WordPress security specialists, we understand the pace at which vulnerabilities appear and the constraints many administrators face. Our aim is to provide clear, actionable guidance so you can reduce risk quickly and recover confidently if compromise occurs.

If you want assistance with scanning, hardening, or monitoring your WordPress sites — including protection against this specific arbitrary file upload vulnerability — consider starting with our free Basic plan to get immediate baseline protections: https://my.wp-firewall.com/buy/wp-firewall-free-plan/

---

Si vous le souhaitez, nous pouvons fournir :

• A site-specific checklist tailored to your hosting environment,
• Example WAF rules ready to deploy (tested for compatibility),
• A forensic playbook and commands to find common web shells.

Contact WP-Firewall support or sign up for the free plan to begin safeguarding your WordPress installations immediately.