CVE-2026-101138: CMP - Coming Soon & Maintenance 4.1.19 - 4.1.20 - Unauthenticated Maintenance Mode Bypass via Custom URL Whitelist
The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 does not correctly apply maintenance mode to pages added to its page whitelist by manually entered URL pattern, allowing unauthenticated visitors to view the content of those pages while maintenance mode is active.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
WordPress sites using NiteoThemes CMP – Coming Soon & Maintenance before version 4.1.21 are exposed if maintenance mode is active and pages have been added to the plugin's whitelist using manually entered URL patterns.
What does an attacker need to exploit it?
No authentication, privileges, or user interaction are required. An unauthenticated visitor only needs to request content from a page affected by a manually entered custom URL whitelist pattern.
What is the impact of successful exploitation?
Visitors can view the content of affected whitelisted pages even while maintenance mode is enabled. The available data indicates confidentiality impact only; it does not indicate integrity or availability impact.
How can administrators determine whether they are affected?
Check whether the installed plugin version is earlier than 4.1.21, then review its maintenance-mode whitelist configuration for pages added through manually entered URL patterns. Pages matching those patterns may be accessible without authentication while maintenance mode is active.