Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.20.10 - Unauthenticated Coming Soon and Maintenance Mode Bypass via Preview Parameters, Excluded URL Keywords and Bypass Cookie
- ID
- WPSEC-2026-2554
- Plugin
- Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode (coming-soon)
- Affected
- all versions before 6.20.11
- Remediation
- Update to 6.20.11 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-288
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-05
- Attack surface
- Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode on WPSec AttackSurface
- Fix released
- Published
Description
The Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to a protection mechanism bypass in all versions up to, and including, 6.20.10. The Coming Soon and Maintenance Mode check stops for any request that has the 'post_type=seedprod' and 'preview=true' parameters, without checking the user's capabilities. When URL exclusion is on, the excluded-URL keywords (such as 'login' or 'account') are matched against the whole request URI, query string included. The role-based access restriction is also skipped whenever any 'wp-seedprod-bypass' cookie is present, without checking its value. This makes it possible for unauthenticated attackers to get past the Coming Soon or Maintenance Mode page and view site content the owner meant to hide.
References
- https://wpsec.com/vuln/WPSEC-2026-2554/
- https://plugins.svn.wordpress.org/coming-soon/tags/6.20.11/
- https://wordpress.org/plugins/coming-soon/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS