PT-2025-14912 · Niteothemes · Niteothemes Cmp – Coming Soon & Maintenance

Savphill · Published 2025-04-04 · Updated 2025-04-07 · CVE-2025-32118

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NiteoThemes CMP – Coming Soon & Maintenance versions through 4.1.13

Description The issue is related to an Unrestricted Upload of File with Dangerous Type, allowing the use of malicious files. This can potentially lead to remote code execution (RCE) exploits.

Recommendations For versions through 4.1.13, update to a version later than 4.1.13 to resolve the issue. As a temporary workaround, consider restricting file uploads to only necessary and safe file types until a patch is available. Avoid using the plugin until the issue is resolved, to minimize the risk of exploitation.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-32118

Affected Products

Niteothemes Cmp – Coming Soon & Maintenance

References · 9

• 🔥 https://github.com/Nxploited/CVE-2025-32118 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-32118 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/cmp-coming-soon-maintenance/vulnerability/wordpress-cmp-coming-soon-maintenance-plugin-4-1-13-remote-code-execution-rce-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1908438467291291741 · Twitter Post
• https://t.me/ckearsenal/633 · Telegram Post
• https://twitter.com/cybercronai/status/1908678700683378694 · Twitter Post
• https://twitter.com/cybercronai/status/1908566646928588870 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/cmp-coming-soon-maintenance/vulnerability/wordpress-cmp-coming-soon-maintenance-plugin-4-1-13-remote-code-execution-rce-vulnerability?_s_id=cve · Note
• https://twitter.com/CveFindCom/status/1909155440543293572 · Twitter Post