{
 "id": "WPSEC-2026-1136",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1136/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1136/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1136/index.md",
 "title": "CMP – Coming Soon & Maintenance Plugin by NiteoThemes <= 4.1.20 - Unauthenticated Coming Soon/Maintenance Mode Bypass via Custom Whitelist URL Patterns",
 "description": "The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to a protection mechanism bypass via the custom URL patterns of the page whitelist in all versions up to, and including, 4.1.20. This is due to insufficient validation of the current request URL in the cmp_page_filter() function. In version 4.1.20 the URL that the custom patterns are compared against is never set, so no custom pattern ever matches. In releases where the URL was set, it was taken from the request without normalisation. This makes it possible for unauthenticated attackers to view pages that the site owner put behind the coming-soon or maintenance page using custom whitelist URL patterns. Exploitation requires the site to restrict the coming-soon or maintenance page to specific pages and to list some of them as custom URL patterns.",
 "plugin": {
  "slug": "cmp-coming-soon-maintenance",
  "name": "CMP – Coming Soon & Maintenance Plugin by NiteoThemes",
  "full_name": "CMP – Coming Soon & Maintenance Plugin by NiteoThemes",
  "wordpress_org": "https://wordpress.org/plugins/cmp-coming-soon-maintenance/",
  "advisories_url": "https://wpsec.com/vuln/plugin/cmp-coming-soon-maintenance/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/cmp-coming-soon-maintenance"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-863"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.1.21",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.1.21"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.1.21",
 "remediation": "Update to 4.1.21 or later.",
 "fix_released": "2026-10-15T19:51:04+00:00",
 "published": "2026-10-16T20:42:05+00:00",
 "updated": "2026-10-16T10:56:09.436493+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1136/",
  "https://plugins.svn.wordpress.org/cmp-coming-soon-maintenance/tags/4.1.21/",
  "https://wordpress.org/plugins/cmp-coming-soon-maintenance/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/cmp-coming-soon-maintenance",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-16"
 }
}