The vulnerability is a Cross‑Site Request Forgery flaw in the Analytify Under Construction, Coming Soon & Maintenance Mode plugin. It allows a malicious actor to compel an authenticated WordPress user to execute unintended requests against the plugin, potentially altering the site’s construction or maintenance configurations. The weakness is classified as CWE‑352 and does not provide remote code execution or other direct system compromise, but it can enable unauthorized configuration changes that could impact site availability or content delivery.

The issue affects all releases of the Analytify Under Construction, Coming Soon & Maintenance Mode plugin up to and including version 2.1.1. Any installation running 2.1.1 or older is potentially vulnerable, regardless of additional plugins or theme configurations.

The CVSS base score of 7.5 indicates a high severity risk. Exploit probability information is not available, and the flaw is not listed in the CISA known exploited vulnerabilities catalog. Based on the description, the attack requires an authenticated user and the attacker must lure the victim into submitting a crafted request to the plugin. Successful exploitation does not enable remote code execution but can lead to unauthorized modifications to the site’s construction or maintenance settings.