Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.20.10 - Authenticated (Editor+) Missing Authorization to Plugin Settings Update

ID

WPSEC-2026-2553

Plugin

Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode (coming-soon)

Affected

all versions before 6.20.11

Remediation

Update to 6.20.11 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

Weakness

CWE-862

Usage

Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-05

Attack surface

Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode on WPSec AttackSurface

Fix released

2026-11-04

Published

2026-11-05

Description

The Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the seedprod_lite_save_settings function in all versions up to, and including, 6.20.10. The function only requires the 'edit_others_posts' capability and stores the submitted settings object as is. This makes it possible for authenticated attackers, with editor-level access and above, to change the plugin's site-wide settings, such as turning Coming Soon or Maintenance Mode on for the whole site or replacing the license key.

References

• https://wpsec.com/vuln/WPSEC-2026-2553/
• https://plugins.svn.wordpress.org/coming-soon/tags/6.20.11/
• https://wordpress.org/plugins/coming-soon/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS