The CMP WordPress plugin contains an authorization bypass in the AJAX action cmp_disable_comingsoon_ajax. The endpoint fails to perform authentication checks and may expose a nonce to anonymous visitors. An attacker can send an HTTP request to /wp-admin/admin-ajax.php?action=cmp_disable_comingsoon_ajax to disable the site’s maintenance or coming‑soon mode, potentially revealing content or enabling subsequent attacks. This flaw is associated with improper authorization (CWE-862).

All installations of the CMP plugin older than version 4.1.18 are affected; no additional vendor or product information is specified beyond the plugin itself.

The vulnerability is triggered by a single unauthenticated request to the plugin’s AJAX endpoint, requiring no credentials or privileged access. The CVSS score is 4.8, EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. Because an attacker can arbitrarily disable a site’s restrictive mode, the potential impact is moderate, making remediation advisable. The likelihood of exploitation remains uncertain, but the ease of exploitation warrants prioritizing the fix.