CVE-2025-62083
Lifecycle Timeline
2Description
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WP Messiah BoomDevs WordPress Coming Soon coming-soon-by-boomdevs allows Retrieve Embedded Sensitive Data.This issue affects BoomDevs WordPress Coming Soon: from n/a through <= 1.0.4.
Analysis
WP Messiah BoomDevs WordPress Coming Soon plugin through version 1.0.4 exposes sensitive system information to unauthorized access, allowing attackers to retrieve embedded sensitive data without authentication. The vulnerability stems from improper access controls on sensitive data endpoints, classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere). With an EPSS score of 0.01% (2nd percentile), exploitation likelihood is minimal despite the information disclosure nature of the defect.
Technical Context
CWE-497 describes a condition where sensitive system information is exposed to an unauthorized control sphere-typically due to missing or inadequate access restrictions on data that should be protected. In WordPress plugins, this commonly manifests when sensitive configuration, user metadata, or system details are returned via REST API endpoints, AJAX handlers, or publicly accessible functions without proper authentication or authorization checks. The BoomDevs Coming Soon plugin, designed to present a landing page before a WordPress site launches, likely exposes internal site configuration or metadata through an unprotected code path. The plugin affects versions up to and including 1.0.4 according to CVE assignment data.
Affected Products
WP Messiah BoomDevs WordPress Coming Soon (plugin slug: coming-soon-by-boomdevs) versions from initial release through 1.0.4 are affected. This is a WordPress plugin distributed via the WordPress.org plugin repository and third-party sources. Administrators using this plugin on any version at or below 1.0.4 should apply updates.
Remediation
Update the BoomDevs WordPress Coming Soon plugin to a version newer than 1.0.4 immediately via the WordPress admin dashboard (Plugins > Installed Plugins > coming-soon-by-boomdevs > Update). If automatic updates are enabled, the patch should be applied automatically. For manual verification, confirm the installed version in wp-content/plugins/coming-soon-by-boomdevs/ or via the WordPress API. Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/coming-soon-by-boomdevs/vulnerability/wordpress-boomdevs-wordpress-coming-soon-plugin-plugin-1-0-4-sensitive-data-exposure-vulnerability for the exact patched version number and additional context.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today