WordPress Plugin Vulnerabilities

CMP – Coming Soon & Maintenance < 4.1.8 - Maintenance Mode Bypass

Description

The plugin does not properly secure maintenance mode, allowing users to bypass it by using a correct cmp_bypass GET parameter in the URL.

Affects Plugins

Plugin icon
cmp-coming-soon-maintenance
Fixed in 4.1.8

References

CVE
CVE-2023-2159
URL
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/cmp-coming-soon-maintenance/cmp-coming-soon-maintenance-417-maintenance-mode-bypass

Miscellaneous

Original Researcher
Marco Wotschka
Verified
No
WPVDB ID
bbfd623f-11ad-4401-86ba-3a119c233340

Timeline

Publicly Published
2023-04-18 (about 3 years ago)
Added
2023-06-09 (about 2 years ago)
Last Updated
2023-06-09 (about 2 years ago)

Other

Published
Title
Published
2025-07-24
Title
PPWP < 1.9.11 - Subscriber+ Access Bypass via REST API
Published
2017-03-03
Title
Adminer <= 1.4.5 - Security Bypass
Published
2014-08-01
Title
WordPress 3.7.1 & 3.8.1 - Privilege Escalation
Published
2014-08-01
Title
WordPress 2.0 - 3.0.1 wp-includes/comment.php Bypass Spam Restrictions
Published
2016-02-04
Title
User Meta Manager <= 3.4.6 - Privilege Escalation