Description
The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 does not correctly apply maintenance mode to pages added to its page whitelist by manually entered URL pattern, allowing unauthenticated visitors to view the content of those pages while maintenance mode is active.
Published: 2026-10-21
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Unauthorized content exposure due to maintenance mode bypass
Action: Upgrade Plugin
AI Analysis

Impact

The CMP – Coming Soon & Maintenance WordPress plugin prior to version 4.1.21 fails to enforce maintenance mode on pages that have been added to its whitelist through manually entered URL patterns. This flaw permits unauthenticated visitors to view the full content of whitelisted pages while the site is supposedly in maintenance mode, inadvertently exposing confidential or sensitive information.

Affected Systems

Any WordPress installation that uses the CMP – Coming Soon & Maintenance plugin with a version earlier than 4.1.21 is susceptible. The vulnerability exists regardless of the specific page URL patterns whitelisted by the site administrator.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA KEV. Because an unauthenticated visitor can trigger the bypass simply by visiting a whitelisted page URL while the site is in maintenance mode, the attack vector is straightforward and does not require privileged access. Once accessed, the attacker receives the same content that a logged‑in user would see, constituting a breach of confidentiality.

Generated by OpenCVE AI on October 21, 2026 at 11:24 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the CMP plugin to version 4.1.21 or newer, which adds correct enforcement of maintenance mode on whitelisted URLs.
  • If upgrading immediately is not possible, temporarily disable the custom URL whitelist feature or remove the problematic entries until a patch is available.
  • After the upgrade or whitelist adjustment, confirm that maintenance mode blocks all content, including previously whitelisted pages, by testing with an unauthenticated browser session.

Generated by OpenCVE AI on October 21, 2026 at 11:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 11:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-285

Wed, 21 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 08:45:00 +0000

Type Values Removed Values Added
Description The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 does not correctly apply maintenance mode to pages added to its page whitelist by manually entered URL pattern, allowing unauthenticated visitors to view the content of those pages while maintenance mode is active.
Title CMP - Coming Soon & Maintenance 4.1.19 - 4.1.20 - Unauthenticated Maintenance Mode Bypass via Custom URL Whitelist
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-10-21T10:14:55.768Z

Reserved: 2026-09-28T07:34:22.085Z

Link: CVE-2026-101138

cve-icon Vulnrichment

Updated: 2026-10-21T10:10:26.438Z

cve-icon NVD

Status : Received

Published: 2026-10-21T09:17:05.760

Modified: 2026-10-21T11:16:59.213

Link: CVE-2026-101138

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T11:30:15Z

Weaknesses