# LightStart <= 2.6.25 - Authenticated (Subscriber+) Missing Authorization to Gutenberg Mode Toggle

- **ID:** WPSEC-2026-3127
- **Plugin:** LightStart – Maintenance Mode, Coming Soon and Landing Page Builder (`wp-maintenance-mode`), https://wordpress.org/plugins/wp-maintenance-mode/
- **Affected versions:** from 2.5.0 before 2.6.26
- **Fixed in:** 2.6.26 (Update to 2.6.26 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-maintenance-mode
- **Fix released:** 2026-11-13
- **Published:** 2026-11-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3127/

## Description

The LightStart – Maintenance Mode, Coming Soon and Landing Page Builder plugin for WordPress is vulnerable to unauthorized modification of data via the wpmm_toggle_gutenberg AJAX action in all versions up to, and including, 2.6.25, due to a missing capability check in the toggle_gutenberg() function and a nonce check whose action is built from the user-supplied 'source' parameter. A nonce from any of the plugin's admin notices passes the check, and some of those notices are shown to every logged-in user. This makes it possible for authenticated attackers, with Subscriber-level access and above, to switch the plugin between its classic and Gutenberg-based maintenance page modes, changing the page shown to visitors while maintenance mode is active.

## References

- https://wpsec.com/vuln/WPSEC-2026-3127/
- https://plugins.svn.wordpress.org/wp-maintenance-mode/tags/2.6.26/
- https://wordpress.org/plugins/wp-maintenance-mode/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3127/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.