CVE-2026-101138 PUBLISHED

CMP - Coming Soon & Maintenance 4.1.19 - 4.1.20 - Unauthenticated Maintenance Mode Bypass via Custom URL Whitelist

Assigner: WPScan
Reserved: 28.09.2026 Published: 21.10.2026 Updated: 21.10.2026

The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 does not correctly apply maintenance mode to pages added to its page whitelist by manually entered URL pattern, allowing unauthenticated visitors to view the content of those pages while maintenance mode is active.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 5.3

Product Status

Vendor Unknown
Product CMP – Coming Soon & Maintenance
Versions Default: unaffected
  • affected from 4.1.19 to 4.1.21 (excl.)

Credits

  • Sanjeev Kumar finder
  • WPScan coordinator

References

Problem Types

  • CWE-284 Improper Access Control CWE