WordPress Plugin Vulnerabilities

CMP - Coming Soon & Maintenance 4.1.19 - 4.1.20 - Unauthenticated Maintenance Mode Bypass via Custom URL Whitelist

Description

The plugin does not correctly apply maintenance mode to pages added to its page whitelist by manually entered URL pattern, allowing unauthenticated visitors to view the content of those pages while maintenance mode is active.

Proof of Concept

Affects Plugins

Plugin icon
cmp-coming-soon-maintenance
Fixed in 4.1.21

References

CVE
CVE-2026-101138

Miscellaneous

Original Researcher
Sanjeev Kumar
Submitter
Sanjeev Kumar
Submitter website
https://www.linkedin.com/in/ksanjeev284/
Verified
Yes
WPVDB ID
ae9f4fa9-e17d-4c52-86c8-48e5ba0dfef8

Timeline

Publicly Published
2026-10-19 (about 2 days ago)
Added
2026-10-19 (about 1 day ago)
Last Updated
2026-10-19 (about 1 day ago)

Other

Published
Title
Published
2016-04-25
Title
iThemes Security <= 5.3.5 - Lack of Capability Check
Published
2026-08-31
Title
Restrict User Access 2.6 - 2.8 - Unauthenticated Content Protection Bypass via REST API Route Normalization
Published
2018-05-10
Title
BBE Theme < 1.53 - Direct Object Reference
Published
2017-05-16
Title
WordPress 3.4.0-4.7.4 - XML-RPC Post Meta Data Lack of Capability Checks
Published
2026-10-19
Title
Simple Shopping Cart < 5.3.3 - Unauthenticated Payment Bypass via Unverified PayPal IPN Recipient