Nixpkgs security tracker

Login with GitHub
⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestion detail

Untriaged
Permalink CVE-2026-13415
7.2 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): High (H)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): High (H)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
created 1 day, 15 hours ago Activity log
  • Created suggestion 1 day, 15 hours ago
CMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Privilege Escalation via cmp_ajax_import_settings

The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls) to update arbitrary WordPress options, including options that lead to privilege escalation to Administrator.

References

Affected products

CMP
  • <4.1.18

Matching in nixpkgs

pkgs.cmph

Free minimal perfect hash C library, providing several algorithms in the literature in a consistent, ease to use, API

pkgs.dtcmp

MPI datatype comparison library

pkgs.ncmpc

Curses-based interface for MPD (music player daemon)

  • nixos-unstable 0.52
    • nixpkgs-unstable 0.52
    • nixos-unstable-small 0.54
  • nixos-26.05 0.52
    • nixos-26.05-small 0.52
    • nixpkgs-26.05-darwin 0.52

pkgs.rnxcmp

Compression/restoration of RINEX observation files developed by Y. Hatanaka of GSI

pkgs.critcmp

Command line tool for comparing benchmarks run by Criterion

pkgs.fstrcmp

Make fuzzy comparisons of strings and byte arrays

  • nixos-unstable 0.7
    • nixpkgs-unstable 0.7
    • nixos-unstable-small 0.7
  • nixos-26.05 0.7
    • nixos-26.05-small 0.7
    • nixpkgs-26.05-darwin 0.7

pkgs.scmpuff

Numeric file shortcuts for common git commands

pkgs.luaPackages.nvim-cmp

A completion plugin for neovim

  • nixos-unstable 1
    • nixpkgs-unstable 1
    • nixos-unstable-small 1
  • nixos-26.05 1
    • nixos-26.05-small 1
    • nixpkgs-26.05-darwin 1

pkgs.haskellPackages.funcmp

Functional MetaPost is a Haskell frontend to the MetaPost language

  • nixos-unstable 1.9
    • nixpkgs-unstable 1.9
    • nixos-unstable-small 1.9
  • nixos-26.05 1.9
    • nixos-26.05-small 1.9
    • nixpkgs-26.05-darwin 1.9

pkgs.lua51Packages.nvim-cmp

A completion plugin for neovim

  • nixos-unstable 1
    • nixpkgs-unstable 1
    • nixos-unstable-small 1
  • nixos-26.05 1
    • nixos-26.05-small 1
    • nixpkgs-26.05-darwin 1

pkgs.lua52Packages.nvim-cmp

A completion plugin for neovim

  • nixos-unstable 1
    • nixpkgs-unstable 1
    • nixos-unstable-small 1
  • nixos-26.05 1
    • nixos-26.05-small 1
    • nixpkgs-26.05-darwin 1

pkgs.lua53Packages.nvim-cmp

A completion plugin for neovim

  • nixos-unstable 1
    • nixpkgs-unstable 1
    • nixos-unstable-small 1
  • nixos-26.05 1
    • nixos-26.05-small 1
    • nixpkgs-26.05-darwin 1

pkgs.luajitPackages.nvim-cmp

A completion plugin for neovim

  • nixos-unstable 1
    • nixpkgs-unstable 1
    • nixos-unstable-small 1
  • nixos-26.05 1
    • nixos-26.05-small 1
    • nixpkgs-26.05-darwin 1