CVE-2020-36730

The CMP for WordPress is vulnerable to authorization bypass due to a missing capability check on the cmp_get_post_detail(), niteo_export_csv(), and cmp_disable_comingsoon_ajax() functions in versions up to, and including, 3.8.1. This makes it possible for unauthenticated attackers to read posts, export subscriber lists, and/or deactivate the plugin.

• CWE-862
• CWE-862

• https://blog.nintechnet.com/multiple-vulnerabilities-fixed-in-cmp-coming-soon-and-maintenance-plugin/Exploit
• https://wpscan.com/vulnerability/10341Third Party Advisory
• https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-cmp-coming-soon-maintenance-by-niteothemes-security-bypass-3-8-1/Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f1ef067b-e4b4-4174-b6ff-ec94a7afd55d?source=cveThird Party Advisory
• https://blog.nintechnet.com/multiple-vulnerabilities-fixed-in-cmp-coming-soon-and-maintenance-plugin/Exploit
• https://wpscan.com/vulnerability/10341Third Party Advisory
• https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-cmp-coming-soon-maintenance-by-niteothemes-security-bypass-3-8-1/Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f1ef067b-e4b4-4174-b6ff-ec94a7afd55d?source=cveThird Party Advisory

Published

Jun 7, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-36725The TI WooCommerce Wishlist and TI WooCommerce Wishlist Pro …8.1
• CVE-2020-36726The Ultimate Reviews plugin for WordPress is vulnerable to P…9.8
• CVE-2020-36727The Newsletter Manager plugin for WordPress is vulnerable to…9.8
• CVE-2020-36728The Adning Advertising plugin for WordPress is vulnerable to…9.8
• CVE-2020-36729The 2J-SlideShow Plugin for WordPress is vulnerable to autho…4.3
• CVE-2020-3673u'Buffer overflow can happen as part of SIP message packet p…9.8
• CVE-2020-36731The Flexible Checkout Fields for WooCommerce plugin for Wor…6.1
• CVE-2020-36732The crypto-js package before 3.2.1 for Node.js generates ran…5.3
• CVE-2020-36735The WP ERP | Complete HR solution with recruitment & job lis…4.3
• CVE-2020-36736The WooCommerce Checkout & Funnel Builder by CartFlows plugi…4.3
• CVE-2020-36737The Import / Export Customizer Settings plugin for WordPress…4.3
• CVE-2020-36738The Cool Timeline (Horizontal & Vertical Timeline) plugin fo…4.3