# Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.20.10 - Unauthenticated Coming Soon and Maintenance Mode Bypass via Preview Parameters, Excluded URL Keywords and Bypass Cookie

- **ID:** WPSEC-2026-2554
- **Plugin:** Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode (`coming-soon`), https://wordpress.org/plugins/coming-soon/
- **Affected versions:** all versions before 6.20.11
- **Fixed in:** 6.20.11 (Update to 6.20.11 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-288
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-05)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/coming-soon
- **Fix released:** 2026-11-04
- **Published:** 2026-11-05
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2554/

## Description

The Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to a protection mechanism bypass in all versions up to, and including, 6.20.10. The Coming Soon and Maintenance Mode check stops for any request that has the 'post_type=seedprod' and 'preview=true' parameters, without checking the user's capabilities. When URL exclusion is on, the excluded-URL keywords (such as 'login' or 'account') are matched against the whole request URI, query string included. The role-based access restriction is also skipped whenever any 'wp-seedprod-bypass' cookie is present, without checking its value. This makes it possible for unauthenticated attackers to get past the Coming Soon or Maintenance Mode page and view site content the owner meant to hide.

## References

- https://wpsec.com/vuln/WPSEC-2026-2554/
- https://plugins.svn.wordpress.org/coming-soon/tags/6.20.11/
- https://wordpress.org/plugins/coming-soon/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2554/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.