CVE-2026-13414 in CMP Plugin
Summary
by MITRE • 08/27/2026
The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain (and exposed to anonymous visitors on others), allowing unauthenticated attackers to disable the site's maintenance/coming-soon mode under a non-default countdown configuration.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified in the Contact Form Manager (CMP) WordPress plugin prior to version 4.1.18 represents a critical failure in access control mechanisms, specifically categorized as Broken Access Control within industry standards such as CWE-269. This flaw stems from an inadequate implementation of authorization checks on specific AJAX endpoints exposed by the plugin. In secure web application architecture, actions that modify system state or configuration must verify not only the authenticity of the request through nonces but also validate that the requesting user possesses the necessary privileges to perform the action. The CMP plugin fails this fundamental security requirement for at least one critical administrative function related to site maintenance settings.
The technical root cause lies in how the plugin handles nonce validation and role-based access control. While WordPress plugins typically rely on nonces to prevent Cross-Site Request Forgery, a robust implementation must also enforce that only users with specific capabilities, such as administrator privileges, can execute sensitive operations. In this instance, the authorization logic is either missing or incorrectly implemented for certain AJAX actions. Furthermore, the nonce validation mechanism is inconsistent; it is skipped entirely in some code paths and exposed to anonymous visitors in others. This inconsistency allows an unauthenticated attacker to bypass security controls by crafting a malicious request that exploits these gaps without needing valid credentials or a proper session context.
The operational impact of this vulnerability is significant for any website utilizing the CMP plugin with a non-default countdown configuration for its maintenance or coming-soon mode. An unauthenticated attacker can exploit this flaw to disable the site's maintenance mode, effectively making the live version of the website publicly accessible when it was intended to be hidden from general users. This exposure can lead to several adverse outcomes including data leakage if sensitive information is visible during the pre-launch phase, potential exploitation of other vulnerabilities in the unpatched or incomplete site content, and reputational damage due to premature public access. Additionally, attackers could potentially use this vector as a stepping stone for further attacks against the WordPress installation by gaining visibility into administrative interfaces that were previously obscured.
Mitigation strategies must prioritize immediate remediation through software updates. Site administrators should upgrade the Contact Form Manager plugin to version 4.1.18 or later, where these authorization checks have been properly implemented and nonce validation has been corrected for all relevant AJAX endpoints. Until an update can be applied, temporary mitigations include restricting access to wp-admin via IP whitelisting if feasible, disabling PHP execution in the uploads directory to prevent potential secondary exploitation vectors, and monitoring server logs for unusual POST requests targeting WordPress AJAX handlers associated with contact form or maintenance settings. Regular security audits focusing on input validation and authorization logic are essential to prevent similar vulnerabilities in future plugin development cycles. This incident underscores the importance of adhering to secure coding practices that align with OWASP guidelines and ensuring that all administrative functions enforce strict role-based access control regardless of nonce presence.