WordPress Plugin Vulnerabilities

Coming Soon Page, Under Construction & Maintenance Mode by SeedProd < 6.19.9 - Editor+ Server-Side Request Forgery

Description

The plugin is vulnerable to Server-Side Request Forgery, making it possible for authenticated attackers with Editor-level access and above to make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services.

Affects Plugins

Plugin icon
coming-soon
Fixed in 6.19.9

References

CVE
CVE-2026-39464
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/87246b00-7a61-4ab4-90f1-2ac42f5b9f1d

Classification

Type
SSRF
OWASP top 10
A1: Injection
CWE
CWE-918
CVSS
5.5 (medium)

Miscellaneous

Original Researcher
timomangcut
Verified
No
WPVDB ID
6dd6f1ae-8040-452e-9b97-499adeea9373

Timeline

Publicly Published
2026-03-14 (about 2 months ago)
Added
2026-05-06 (about 9 days ago)
Last Updated
2026-05-06 (about 9 days ago)

Other

Published
Title
Published
2025-03-06
Title
Platform.ly for WooCommerce < 1.1.7 - Unauthenticated Blind Server-Side Request Forgery
Published
2025-09-22
Title
Beaf <= 1.6.2 - Authenticated (Admin+) Server-Side Request Forgery
Published
2024-12-11
Title
Hurrakify < 8.0.1 - Unauthenticated Server-Side Request Forgery
Published
2025-10-27
Title
Auto Featured Image (Auto Post Thumbnail) < 4.2.0 - Authenticated (Author+) Server-Side Request Forgery
Published
2025-09-05
Title
Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One <= 2.2.6 - Authenticated (Subscriber+) Server-Side Request Forgery