CMP – Coming Soon & Maintenance Plugin by NiteoThemes, CVE-2026-13414
- CVE, Research URL
- Published on
- Aug 27, 2026
- Research Description
- The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain (and exposed to anonymous visitors on others), allowing unauthenticated attackers to disable the site's maintenance/coming-soon mode under a non-default countdown configuration.
- Affected versions
-
max 4.1.18.
- Status
-
vulnerable