{
 "id": "WPSEC-2026-2554",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2554/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2554/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2554/index.md",
 "title": "Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.20.10 - Unauthenticated Coming Soon and Maintenance Mode Bypass via Preview Parameters, Excluded URL Keywords and Bypass Cookie",
 "description": "The Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to a protection mechanism bypass in all versions up to, and including, 6.20.10. The Coming Soon and Maintenance Mode check stops for any request that has the 'post_type=seedprod' and 'preview=true' parameters, without checking the user's capabilities. When URL exclusion is on, the excluded-URL keywords (such as 'login' or 'account') are matched against the whole request URI, query string included. The role-based access restriction is also skipped whenever any 'wp-seedprod-bypass' cookie is present, without checking its value. This makes it possible for unauthenticated attackers to get past the Coming Soon or Maintenance Mode page and view site content the owner meant to hide.",
 "plugin": {
  "slug": "coming-soon",
  "name": "Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode",
  "full_name": "Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode",
  "wordpress_org": "https://wordpress.org/plugins/coming-soon/",
  "advisories_url": "https://wpsec.com/vuln/plugin/coming-soon/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/coming-soon"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-288"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "6.20.11",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 6.20.11"
  ]
 },
 "introduced_in": null,
 "fixed_in": "6.20.11",
 "remediation": "Update to 6.20.11 or later.",
 "fix_released": "2026-11-04T09:14:36+00:00",
 "published": "2026-11-05T09:48:23+00:00",
 "updated": "2026-11-04T13:57:28.426295+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2554/",
  "https://plugins.svn.wordpress.org/coming-soon/tags/6.20.11/",
  "https://wordpress.org/plugins/coming-soon/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/coming-soon",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-05"
 }
}