# Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.20.10 - Authenticated (Editor+) Missing Authorization to Plugin Settings Update

- **ID:** WPSEC-2026-2553
- **Plugin:** Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode (`coming-soon`), https://wordpress.org/plugins/coming-soon/
- **Affected versions:** all versions before 6.20.11
- **Fixed in:** 6.20.11 (Update to 6.20.11 or later.)
- **Severity:** Low 3.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-05)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/coming-soon
- **Fix released:** 2026-11-04
- **Published:** 2026-11-05
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2553/

## Description

The Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the seedprod_lite_save_settings function in all versions up to, and including, 6.20.10. The function only requires the 'edit_others_posts' capability and stores the submitted settings object as is. This makes it possible for authenticated attackers, with editor-level access and above, to change the plugin's site-wide settings, such as turning Coming Soon or Maintenance Mode on for the whole site or replacing the license key.

## References

- https://wpsec.com/vuln/WPSEC-2026-2553/
- https://plugins.svn.wordpress.org/coming-soon/tags/6.20.11/
- https://wordpress.org/plugins/coming-soon/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2553/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.