# CMP – Coming Soon & Maintenance Plugin by NiteoThemes <= 4.1.20 - Unauthenticated Coming Soon/Maintenance Mode Bypass via Custom Whitelist URL Patterns

- **ID:** WPSEC-2026-1136
- **Plugin:** CMP – Coming Soon & Maintenance Plugin by NiteoThemes (`cmp-coming-soon-maintenance`), https://wordpress.org/plugins/cmp-coming-soon-maintenance/
- **Affected versions:** all versions before 4.1.21
- **Fixed in:** 4.1.21 (Update to 4.1.21 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-863
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/cmp-coming-soon-maintenance
- **Fix released:** 2026-10-15
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1136/

## Description

The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to a protection mechanism bypass via the custom URL patterns of the page whitelist in all versions up to, and including, 4.1.20. This is due to insufficient validation of the current request URL in the cmp_page_filter() function. In version 4.1.20 the URL that the custom patterns are compared against is never set, so no custom pattern ever matches. In releases where the URL was set, it was taken from the request without normalisation. This makes it possible for unauthenticated attackers to view pages that the site owner put behind the coming-soon or maintenance page using custom whitelist URL patterns. Exploitation requires the site to restrict the coming-soon or maintenance page to specific pages and to list some of them as custom URL patterns.

## References

- https://wpsec.com/vuln/WPSEC-2026-1136/
- https://plugins.svn.wordpress.org/cmp-coming-soon-maintenance/tags/4.1.21/
- https://wordpress.org/plugins/cmp-coming-soon-maintenance/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1136/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.