CVE-2026-101138 in CMP Plugin
Summary
by MITRE • 10/22/2026
The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 does not correctly apply maintenance mode to pages added to its page whitelist by manually entered URL pattern, allowing unauthenticated visitors to view the content of those pages while maintenance mode is active.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in the CMP – Coming Soon & Maintenance WordPress plugin prior to version 4.1.21 represents a critical failure in access control mechanisms during site maintenance operations. This flaw specifically affects the functionality designed to restrict public access by enforcing a global maintenance mode, which is commonly used for website updates or temporary closures. The core issue lies within the logic governing the page whitelist feature, where administrators can specify URLs that should remain accessible even when the rest of the site is locked down. While this feature is intended to allow developers and stakeholders to preview specific pages without disabling the overall maintenance state, the implementation contains a logical error in how these whitelisted paths are validated against incoming requests.
Technically, the vulnerability stems from an improper validation or application of access control rules for URLs entered manually into the whitelist configuration. When unauthenticated visitors attempt to access resources that match the patterns defined in this whitelist, the plugin fails to correctly apply the maintenance mode restrictions. Instead of enforcing the expected denial of service or redirection associated with the active maintenance state, the server processes these requests and serves the content as if standard browsing permissions were granted. This indicates a breakdown in the security boundary between authenticated administrative configurations and unauthenticated user access, allowing bypasses that circumvent intended protective measures. The flaw is particularly insidious because it relies on manual input patterns rather than hardcoded paths, meaning any pattern incorrectly defined or processed by the plugin's internal logic can lead to unintended exposure of sensitive site content.
The operational impact of this vulnerability allows unauthenticated attackers to view and potentially interact with parts of a WordPress website that are supposed to be hidden during maintenance periods. This exposure can range from minor informational leakage to significant security risks, depending on the nature of the whitelisted pages. If these pages contain administrative interfaces, user registration forms, or sensitive data processing endpoints, their accessibility could facilitate further attacks such as credential stuffing, social engineering, or exploitation of other vulnerabilities within those specific components. For organizations relying on this plugin to maintain a secure facade during updates, this flaw undermines trust and exposes the infrastructure to reconnaissance activities that would otherwise be blocked by the maintenance mode protocol.
From a classification perspective, this issue aligns with CWE-284 Improper Access Control, as it involves a failure to properly restrict access for unauthorized actors. It also relates to CWE-601 URL Redirection to Untrusted Site ('Open Redirect') in terms of logic flow errors, though more accurately fits CWE-798 Use of Hard-coded Credentials or Configuration Data if the whitelist is treated as trusted input without sufficient sanitization and validation against security policies. In the context of the MITRE ATT&CK framework, this vulnerability facilitates Initial Access by allowing adversaries to gather information about the target environment during a period when defensive measures are typically relaxed or misconfigured. It enables reconnaissance activities that can be leveraged for subsequent exploitation phases.
Mitigation strategies must focus on immediate remediation and long-term security hardening. The primary recommendation is to upgrade the CMP – Coming Soon & Maintenance plugin to version 4.1.21 or later, where this logical flaw has been addressed by developers through corrected validation routines for whitelisted URL patterns. Administrators should also review their current whitelist configurations to ensure that no sensitive pages are inadvertently exposed until the update is applied. In environments where immediate patching is not feasible, temporary workarounds may include disabling the maintenance mode entirely if acceptable risk levels permit, or manually restricting access via server-level configuration files such as .htaccess for Apache or Nginx rules, which can enforce stricter access controls independent of the plugin's internal logic. Regular auditing of third-party plugins and adherence to least-privilege principles in whitelist management are essential practices to prevent similar vulnerabilities from impacting organizational security posture.