Cmp Coming Soon Maintenance
Monthly
Unauthenticated visitors can view the content of maintenance-exempt pages on WordPress sites running CMP - Coming Soon & Maintenance plugin before 4.1.21 when the operator has enabled maintenance mode and manually whitelisted pages by URL pattern. The disclosure is limited to those explicitly whitelisted pages and requires that non-default configuration; publicly available exploit code exists.
Content disclosure in WordPress sites using the CMP - Coming Soon & Maintenance plugin before version 4.1.20 allows unauthenticated visitors to bypass the maintenance/coming-soon gate by shaping a request that the plugin mistakes for a login request, reaching hidden published pages and other gated content. This moderate-severity access-control flaw (CVSS 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) requires no authentication or user interaction and only matters while the site is actively in maintenance or coming-soon mode. Publicly available exploit code exists (WPScan advisory), but there is no CISA KEV confirmation of active exploitation; impact is limited to information disclosure with no write access, code execution, or availability impact, and disappears once the site is fully public and the plugin mode is off.
Unauthenticated visitors can view the content of maintenance-exempt pages on WordPress sites running CMP - Coming Soon & Maintenance plugin before 4.1.21 when the operator has enabled maintenance mode and manually whitelisted pages by URL pattern. The disclosure is limited to those explicitly whitelisted pages and requires that non-default configuration; publicly available exploit code exists.
Content disclosure in WordPress sites using the CMP - Coming Soon & Maintenance plugin before version 4.1.20 allows unauthenticated visitors to bypass the maintenance/coming-soon gate by shaping a request that the plugin mistakes for a login request, reaching hidden published pages and other gated content. This moderate-severity access-control flaw (CVSS 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) requires no authentication or user interaction and only matters while the site is actively in maintenance or coming-soon mode. Publicly available exploit code exists (WPScan advisory), but there is no CISA KEV confirmation of active exploitation; impact is limited to information disclosure with no write access, code execution, or availability impact, and disappears once the site is fully public and the plugin mode is off.