CVE-2026-101138

Deferred Deferred - Pending Action

CMP Plugin Maintenance Mode Bypass via Whitelisted URLs

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: WPScan

Description

The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 does not correctly apply maintenance mode to pages added to its page whitelist by manually entered URL pattern, allowing unauthenticated visitors to view the content of those pages while maintenance mode is active.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-21

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-101138

EUVD

EUVD-2026-107141

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	CMP – Coming Soon & Maintenance	4.1.19

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

The CMP – Coming Soon & Maintenance WordPress plugin before version 4.1.21 has a flaw where manually entered URL patterns in the page whitelist do not correctly enforce maintenance mode. This allows unauthenticated visitors to view whitelisted pages even when maintenance mode is active.

Detection Guidance

Check the installed version of the CMP – Coming Soon & Maintenance plugin. If it is 4.1.19 or 4.1.20, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the version.

Impact Analysis

Unauthenticated users can access restricted content during maintenance mode, potentially exposing sensitive information intended only for administrators or authorized users.

Compliance Impact

This vulnerability could potentially violate compliance with standards like GDPR or HIPAA by exposing restricted content to unauthenticated users during maintenance mode. If sensitive data is included in the whitelisted pages, unauthorized access may lead to data breaches or non-compliance with privacy regulations.

Mitigation Strategies

Update the CMP – Coming Soon & Maintenance plugin to version 4.1.21 or later immediately. Disable the plugin temporarily if an update is not possible until the update is applied.

Hi! I’m here to help you understand CVE-2026-101138. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...