Medium
CMP - Coming Soon & Maintenance 4.1.19 - 4.1.20 - Unauthenticated Maintenance Mode Bypass via Custom URL Whitelist
The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 does not correctly apply maintenance mode to pages added to its page whitelist by manually entered URL pattern, allowing unauthenticated visitors to view the content of those pages while maintenance mode is active.
Announced Source revision 1
Original source ↗CVE-2026-101138
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-101138
CMP – Coming Soon & Maintenance
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Unknown",
"product": "CMP – Coming Soon & Maintenance",
"versions": [
{
"status": "affected",
"version": "4.1.19",
"lessThan": "4.1.21",
"versionType": "semver"
}
],
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-101138
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #45750 · Revision 1
- Added to Heist Feed
- Publisher date