Under Construction Coming Soon Maintenance Mode EUVD-2026-19590

Requires WordPress site with Analytify Under Construction, Coming Soon & Maintenance Mode plugin versions up to 2.1.1 installed and active. Victim must be logged into WordPress admin and click attacker-crafted link. Exploit requires high attack complexity due to CSRF token validation.

While the CVSS base score of 7.5 rates this as high severity with potential for high confidentiality, integrity, and availability impact, real-world exploitation risk is moderated by several factors. The attack vector requires network access (AV:N) but has high complexity (AC:H) and mandatory user interaction (UI:R), meaning successful exploitation depends on tricking an authenticated administrator into visiting a malicious page while logged into WordPress. No privileges are required for the attacker (PR:N), but the attack cannot execute without administrator cooperation. No public exploit code exists and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation. EPSS probability data is unavailable for assessment. From an SSVC perspective, while the technical impact is high (potential configuration changes to site maintenance settings), the exploitation barrier requiring social engineering and precise timing reduces automatable exploitation potential. This represents a moderate priority for WordPress administrators using this plugin, particularly for high-value sites where administrative account compromise would be severe, but does not warrant emergency patching unless actively targeted.

An attacker researches WordPress sites using the Under Construction plugin and identifies a target administrator through LinkedIn or site contact pages. The attacker crafts a malicious webpage containing hidden forms that auto-submit requests to the target WordPress site's plugin configuration endpoints, such as changing maintenance mode settings, modifying redirect URLs, or altering plugin configurations. The attacker sends a phishing email to the administrator with a compelling pretext to visit the malicious page while logged into their WordPress dashboard. Upon visiting the page, the victim's browser automatically submits the forged requests with their authenticated session cookies, causing unauthorized configuration changes without the administrator's knowledge or consent. No public exploit code exists, but the attack methodology is well-understood and easily reproducible by attackers familiar with CSRF exploitation techniques.