The vulnerability resides in the Conditional Maintenance Mode for WordPress plugin, where a missing nonce check permits an unauthenticated attacker to craft a request that flips the site’s maintenance status. An attacker must sidestep the normal WordPress authentication flow – typically by enticing an administrator to click a malicious link – but once a forged request is sent the plugin will enable or disable maintenance mode without any further verification. The impact is limited to configuration changes that can deny legitimate traffic or expose the site under maintenance, but it does not directly lead to code execution or data theft.

The plugin by Evolurise, named Conditional Maintenance Mode for WordPress, is affected in all releases up to and including version 1.0.0. Any WordPress installation that has installed or activated this plugin within those versions is at risk.

The CVSS score is 4.3, indicating a low‑to‑moderate severity, and the EPSS score is reported as < 1%, showing an extremely low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog. Exploitation requires only the ability to persuade an administrative user to click a link, making the attack vector a social‑engineering web request that bypasses nonce protection. Once the designed request is delivered, the plugin will alter the maintenance mode state unconditionally.