CMP – Coming Soon & Maintenance Plugin by NiteoThemes <= 4.1.20 - Unauthenticated Coming Soon/Maintenance Mode Bypass via Custom Whitelist URL Patterns
- ID
- WPSEC-2026-1136
- Plugin
- CMP – Coming Soon & Maintenance Plugin by NiteoThemes (cmp-coming-soon-maintenance)
- Affected
- all versions before 4.1.21
- Remediation
- Update to 4.1.21 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-863
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-16
- Attack surface
- CMP – Coming Soon & Maintenance Plugin by NiteoThemes on WPSec AttackSurface
- Fix released
- Published
Description
The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to a protection mechanism bypass via the custom URL patterns of the page whitelist in all versions up to, and including, 4.1.20. This is due to insufficient validation of the current request URL in the cmp_page_filter() function. In version 4.1.20 the URL that the custom patterns are compared against is never set, so no custom pattern ever matches. In releases where the URL was set, it was taken from the request without normalisation. This makes it possible for unauthenticated attackers to view pages that the site owner put behind the coming-soon or maintenance page using custom whitelist URL patterns. Exploitation requires the site to restrict the coming-soon or maintenance page to specific pages and to list some of them as custom URL patterns.
References
- https://wpsec.com/vuln/WPSEC-2026-1136/
- https://plugins.svn.wordpress.org/cmp-coming-soon-maintenance/tags/4.1.21/
- https://wordpress.org/plugins/cmp-coming-soon-maintenance/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS