Description
WordPress Plugin Curtain 1.0.2 contains a cross-site request forgery vulnerability that allows attackers to activate or deactivate site maintenance mode by crafting malicious requests. Attackers can trick authenticated administrators into submitting forged requests to the options-general.php page with curtain parameters to toggle maintenance mode without valid nonce validation.
Published: 2026-05-10
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

WordPress Plugin Curtain 1.0.2 has a cross‑site request forgery vulnerability that lets attackers toggle site maintenance mode by sending forged requests. The flaw stems from missing nonce validation when calling options‑general.php with curtain parameters, enabling an attacker to activate or deactivate maintenance mode without permission.

Affected Systems

The vulnerability affects the Curtain plugin version 1.0.2 deployed on WordPress sites. Any installation of this plugin, when enabled, is susceptible.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. A typical exploitation path requires an attacker to coerce an authenticated administrator into submitting a malicious request, relying on the absence of nonce validation to perform an unauthorized state change.

Generated by OpenCVE AI on May 10, 2026 at 13:26 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Curtain plugin to the latest official release or patch that removes the CSRF flaw
  • If the plugin is not essential, deactivate or uninstall it to eliminate the attack surface
  • Limit administrator access to trusted accounts, enforce multi‑factor authentication, and monitor for unexpected changes to site maintenance state

Generated by OpenCVE AI on May 10, 2026 at 13:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 11 May 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 10 May 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Curtain
Curtain curtain
Wordpress
Wordpress wordpress
Vendors & Products Curtain
Curtain curtain
Wordpress
Wordpress wordpress

Sun, 10 May 2026 12:45:00 +0000

Type Values Removed Values Added
Description WordPress Plugin Curtain 1.0.2 contains a cross-site request forgery vulnerability that allows attackers to activate or deactivate site maintenance mode by crafting malicious requests. Attackers can trick authenticated administrators into submitting forged requests to the options-general.php page with curtain parameters to toggle maintenance mode without valid nonce validation.
Title WordPress Plugin Curtain 1.0.2 Cross-site Request Forgery
First Time appeared Curtain Project
Curtain Project curtain
Weaknesses CWE-352
CPEs cpe:2.3:a:curtain_project:curtain:1.0.2:*:*:*:*:wordpress:*:*
Vendors & Products Curtain Project
Curtain Project curtain
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L'}

Subscriptions

Curtain Curtain
Curtain Project Curtain
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-05-11T14:49:35.155Z

Reserved: 2026-01-11T13:34:26.332Z

Link: CVE-2022-50955

cve-icon Vulnrichment

Updated: 2026-05-11T14:49:31.743Z

cve-icon NVD

Status : Received

Published: 2026-05-10T13:16:33.047

Modified: 2026-05-10T13:16:33.047

Link: CVE-2022-50955

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-10T21:23:54Z

Weaknesses