CMP Coming Soon CVE-2026-101138

Exploitation requires that the site operator has (1) activated the CMP plugin's maintenance mode and (2) added one or more pages to the plugin's page whitelist using a manually entered URL pattern - this specific whitelist-by-URL-pattern configuration is the exact trigger named in the description. Only the content of those whitelisted pages is exposed; non-whitelisted pages remain protected, so the disclosure scope is limited to pages the operator explicitly configured. The limiting factor is therefore this non-default, operator-dependent whitelist configuration: a site running CMP maintenance mode with no manually whitelisted URL patterns is not exposed. No authentication or user interaction is required once the condition exists (PR:N/UI:N).

This is a genuinely low-to-moderate priority issue despite the vocabulary of 'unauthenticated' exploitation. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3 Medium) is internally consistent with the description: a network-reachable, low-complexity flaw requiring no privileges or user interaction, but with only Low confidentiality impact and no integrity or availability impact. The real-world severity is bounded by what the flaw actually exposes - it leaks the content of pages the site owner themselves added to a maintenance-mode whitelist, not arbitrary backend data, credentials, or configuration. No EPSS score and no SSVC decision data were provided, so automatability and exploitation-maturity cannot be scored from the input. The flaw is NOT in CISA KEV (not confirmed actively exploited), but a public exploit reference exists via WPScan, so exploit code availability and active exploitation must be treated as distinct: code exists, but there is no evidence of exploitation in the wild. Net: a legitimate information-disclosure bug worth patching on the normal cycle, not an emergency - the low confidentiality-only impact and the dependency on a specific operator-created whitelist configuration keep real-world risk modest.

A site operator enables the CMP plugin's maintenance mode and whitelists certain pages by manually entering URL patterns, expecting other pages to stay hidden. Because the plugin fails to correctly apply maintenance mode to those whitelisted pages, an unauthenticated visitor can simply request a matching URL and read the page content while the site is supposedly offline. A public exploit/advisory for this behavior is available via WPScan, and the low attack complexity (AC:L) means exploitation is as simple as navigating to the affected URL.