All vulnerabilities
CVE-2026-13413

CMP - Coming Soon & Maintenance < 4.1.20 - Unauthenticated Maintenance Mode Bypass via Login URL Match

Unknown CMP – Coming Soon & Maintenance
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.25%Chance of exploitation activity in the next 30 days, higher than 15% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.1.20Fixed versionCVE List
Published2 Oct 2026Updated 2 Oct 2026CVE List

What fixes it

  • 4.1.20CMP – Coming Soon & MaintenanceCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.20 does not correctly restrict access to the site while maintenance/coming-soon mode is enabled, allowing unauthenticated visitors to bypass the coming-soon page and reach the otherwise hidden site, including hidden published pages, by shaping the request so it is mistaken for a login request.

Text from CVE List

Affected versions 1

  • CMP – Coming Soon & Maintenanceaffected: all versions before 4.1.20CVE List

References 1