CVE-2026-13414: CMP - Coming Soon & Maintenance < 4.1.18 - Unauthenticated Maintenance Mode Disable via cmp_disable_comingsoon_ajax
The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain (and exposed to anonymous visitors on others), allowing unauthenticated attackers to disable the site's maintenance/coming-soon mode under a non-default countdown configuration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress CMP (Coming Soon & Maintenance) pluginto a version that resolves this vulnerability.Fixed in 4.1.18Patch cmp_disable_comingsoon_ajax
Event History
Frequently Asked Questions
Which sites are exposed to unauthenticated disabling of maintenance mode?
Sites using the CMP WordPress plugin before version 4.1.18 are exposed when maintenance or coming-soon mode is configured with the affected non-default countdown configuration.
Does an attacker need a WordPress account to exploit this issue?
No. The affected AJAX action can be reached by unauthenticated attackers because it lacks authorization checks and the nonce protection can be bypassed or is exposed to anonymous visitors in affected cases.
Are default CMP configurations affected?
The issue is described as requiring a non-default countdown configuration. The provided information does not indicate that the default countdown configuration is affected.
What is the impact of successful exploitation?
An attacker can disable the site's maintenance or coming-soon mode, potentially making the site publicly accessible when it was intended to remain unavailable.