CVE-2026-13413: CMP - Coming Soon & Maintenance < 4.1.20 - Unauthenticated Maintenance Mode Bypass via Login URL Match
The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.20 does not correctly restrict access to the site while maintenance/coming-soon mode is enabled, allowing unauthenticated visitors to bypass the coming-soon page and reach the otherwise hidden site, including hidden published pages, by shaping the request so it is mistaken for a login request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CMP – Coming Soon & Maintenanceto a version that resolves this vulnerability.Fixed in 4.1.20
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using CMP – Coming Soon & Maintenance versions earlier than 4.1.20 with maintenance or coming-soon mode enabled are exposed. Unauthenticated visitors can reach content that the mode is intended to hide.
What does an attacker need to exploit it?
No authentication or user interaction is required. An attacker only needs network access to the affected site and can shape a request so it is treated as a login request.
What content may be exposed?
The bypass can expose the otherwise hidden site, including hidden published pages. The available information does not indicate that the flaw allows modification of site content or service disruption.