CVE-2026-13414
Received Received - Intake

Unauthenticated Maintenance Mode Bypass in CMP WordPress Plugin

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: WPScan

Description
The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain (and exposed to anonymous visitors on others), allowing unauthenticated attackers to disable the site's maintenance/coming-soon mode under a non-default countdown configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-13414
EUVD
EUVD-2026-66867

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpbeaverbuilder cmp_coming_soon_and_maintenance to 4.1.18 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The CVE-2026-13414 vulnerability affects the WordPress plugin 'CMP – Coming Soon & Maintenance' versions before 4.1.18. It allows unauthenticated attackers to disable a site's maintenance or coming-soon mode by exploiting a missing authorization check on an AJAX action. The issue relies on a nonce that is either skipped or exposed to anonymous visitors depending on the theme, specifically impacting sites with a non-default countdown configuration.

Detection Guidance

Check if the CMP plugin version is below 4.1.18 by inspecting the WordPress admin panel under Plugins. Look for signs of unauthorized maintenance mode changes or unusual AJAX requests in server logs.

Impact Analysis

This vulnerability allows attackers to bypass the maintenance or coming-soon mode of a WordPress site without authentication. If exploited, it could expose the site to visitors while it is supposed to be restricted, potentially leading to unauthorized access or data exposure during maintenance periods.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It allows unauthenticated attackers to disable a site's maintenance or coming-soon mode, which could temporarily expose under-construction pages. However, this is not a data breach or unauthorized access to sensitive information.

Mitigation Strategies

Update the CMP plugin to version 4.1.18 or later immediately. If updating is not possible, consider disabling the plugin temporarily until an update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13414. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart