Vulnerabilities

TI-2023-02027 CVE-2023-2159 · GHSA-vw9j-prfj-jvhh

CMP – Coming Soon & Maintenance <= 4.1.7 - Maintenance Mode Bypass

LOW 31

The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Maintenance Mode Bypass in versions up to, and including, 4.1.7.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00772 Published 2023-06-09 No fix listed CWE-284

TI-2020-18901 CVE-2020-36730 · GHSA-5xcm-h8cp-6mw3

CMP <= 3.8.1 - Missing Authorization

MEDIUM 50

The CMP for WordPress is vulnerable to authorization bypass due to a missing capability check on the cmp_get_post_detail(), niteo_export_csv(), and cmp_disable_comingsoon_ajax() functions in versions up to, and including…

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.02269 Published 2023-06-07 No fix listed CWE-862

TI-2022-00127 CVE-2022-0188 · GHSA-3rrw-2rpr-xr39

Coming Soon & Maintenance Plugin by NiteoThemes < 4.0.19 - Unauthenticated Arbitrary CSS Update

LOW 29

The CMP WordPress plugin before 4.0.19 allows any user, even not logged in, to arbitrarily change the coming soon page layout.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02315 Published 2022-02-14 Fixed in 4.0.19 CWE-306

Vulnerabilities

Filters

CMP – Coming Soon & Maintenance <= 4.1.7 - Maintenance Mode Bypass

CMP <= 3.8.1 - Missing Authorization

Coming Soon & Maintenance Plugin by NiteoThemes < 4.0.19 - Unauthenticated Arbitrary CSS Update