CMP Coming Soon & Maintenance CVE-2026-13413

Exploitation requires that the target WordPress site has the CMP - Coming Soon & Maintenance plugin (version before 4.1.20) installed and actively running in maintenance or coming-soon mode - the vulnerability only matters while that gate is enabled, since its purpose is to defeat that gate. No authentication, user interaction, or non-default configuration is otherwise needed: an unauthenticated remote visitor simply shapes a request so the plugin misclassifies it as a login request and is let through. The practical limiting factor is that only content the operator chose to hide (hidden/published pages behind the maintenance screen) is exposed; there is no write access, no code execution, and no impact once the site is fully public and the plugin's mode is off.

This is a genuine but moderate-severity information-disclosure/access-control flaw, not a critical priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, score 5.3) indicates trivially easy remote unauthenticated exploitation with only limited confidentiality impact and no integrity or availability effect - consistent with the described ability to view content the operator intended to hide rather than to compromise the site. Publicly available exploit code exists (reported by WPScan), which raises practical risk because the technique (shaping a request to look like a login request) is low-effort and repeatable. No CISA KEV listing and no EPSS score were provided in the input, so there is no evidence of active in-the-wild exploitation; absence of these signals suggests this is currently opportunistic/low-urgency rather than mass-exploited. The real-world risk is that a site under maintenance/coming-soon mode (often used precisely to keep unfinished or embargoed content private) leaks its hidden published pages to anyone who knows the bypass - meaningful for confidentiality-sensitive pre-launch content but not a system-compromise issue.

An attacker targets a WordPress site displaying the CMP coming-soon or maintenance page and wants to see the hidden content behind it. They craft an HTTP request shaped so the plugin mistakes it for a login request, bypassing the gate and loading otherwise-hidden published pages. A public proof-of-concept documented by WPScan exists, and because exploitation is remote, unauthenticated, and low-complexity, it requires no special skill or access.