CMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Privilege Escalation via cmp_ajax_import_settings

Description

The plugin does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role (when the administrator has granted the Editor role access to the plugin's admin-bar controls) to update arbitrary WordPress options, including options that lead to privilege escalation to Administrator.