Skip to content
Sign in
5.3 Medium

CVE-2026-13413 The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.20 does not correctly restrict access to the site…

Description

The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.20 does not correctly restrict access to the site while maintenance/coming-soon mode is enabled, allowing unauthenticated visitors to bypass the coming-soon page and reach the otherwise hidden site, including hidden published pages, by shaping the request so it is mistaken for a login request.

Affected products and versions

Product Affected versions Fixed in
CMP – Coming Soon & Maintenance 4.1 earliest → < 4.1.20 4.1.20

Other CVEs of CMP – Coming Soon & Maintenance

The 2 CVEs of CMP – Coming Soon & Maintenance →
CVE-2026-101138 The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 does not correctly apply maintenance mode to pages… 5.3 Medium
Track this CVE