Easy Maintenance Mode <= 1.4.2 - Information Exposure
Priority LOW 30CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.
Summary
The Easy Maintenance Mode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2 via the REST API. This makes it possible for authenticated attackers to obtain post and page content via REST API thus bypassign the protection provided by the plugin.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00432 37th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| a.ankit | Easy Maintenance Mode | up to 1.4.2 | — | No fix listed | CNA |
- Easy Maintenance Mode Vendora.ankit Affected up to 1.4.2 Fixed in — No fix listed CNA
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mukeshpanchal:easy_maintenance_mode:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:mukeshpanchal:easy_maintenance_mode:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-1477
- 2026-10-03 Alias added: GHSA-95wg-jpqm-5g5h
References
More a.ankit vulnerabilities
- TI-2025-22576 WordPress Easy Custom CSS plugin <= 1.0 - CSRF to Stored XSS vulnerability CVSS 3.1HIGH 7.1
- TI-2025-17410 WordPress ReadMe Creator plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability CVSS 3.1HIGH 7.1
- TI-2024-34548 WordPress Webriti Custom Login plugin <= 0.3 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability CVSS 3.1HIGH 7.1
- TI-2025-11166 SpiceForms Form Builder <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVSS 3.1MEDIUM 6.4
Sources
- CVE-2024-1477 · CVE Program
- CVE-2024-1477 · NVD
- FIRST EPSS
- GHSA-95wg-jpqm-5g5h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences