The SeedProd Coming Soon Page, Under Construction & Maintenance Mode plugin is affected by a missing authorization flaw that allows an attacker to bypass the plugin’s access control checks. By exploiting this defect, an adversary can reach administrative functions of the plugin that are intended to be restricted to privileged users. This could enable unauthorized modification of site status, visibility of maintenance mode settings, and potentially the ability to alter or disable security controls on the WordPress site.

WordPress sites that have the SeedProd Coming Soon Page, Under Construction & Maintenance Mode plugin installed at any version up to and including 6.19.8 are vulnerable to this weakness.

The vulnerability carries a CVSS score of 5.3, indicating moderate severity. The EPSS score is reported as less than 1 %, suggesting a very low exploitation probability, and the issue is not listed in the CISA KEV catalog. The likely attack vector is remote, where an unauthenticated or low-privilege user can access the plugin’s administrative endpoints. Exploitation requires no special conditions beyond reaching the plugin’s URLs, so the risk to exposed sites remains significant enough to warrant timely remediation.