The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 fails to enforce maintenance mode on pages that have been added to its whitelist through manually entered URL patterns. This flaw permits unauthenticated visitors to view the full content of whitelisted pages while the site is supposedly in maintenance mode, concealing confidential or sensitive information.

Any WordPress installation that uses the CMP – Coming Soon & Maintenance plugin with a version earlier than 4.1.21 is vulnerable. The issue exists regardless of which page URLs are whitelisted by the site administrator.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of < 1% suggests a very low probability of exploitation and the vulnerability is not listed in CISA KEV. An unauthenticated visitor can trigger the bypass simply by visiting a whitelisted page URL while the site is in maintenance mode, so the attack vector is straightforward and does not require privileged access. Once accessed, the attacker receives the same content that a logged‑in user would see, constituting a breach of confidentiality.