Description

The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain (and exposed to anonymous visitors on others), allowing unauthenticated attackers to disable the site's maintenance/coming-soon mode under a non-default countdown configuration.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.8",
  "pubDate": "2026-08-27T06:16:55.207Z",
  "pubdate": "2026-08-27T06:16:55.207Z",
  "executiveSummary": "The CMP WordPress plugin, in versions prior to 4.1.18, contains a critical security flaw involving improper authorization on an AJAX action. The vulnerability allows unauthenticated remote attackers to modify the site's maintenance or coming-soon mode settings.\nThis vulnerability stems from a missing authorization check combined with a flawed nonce implementation. While the plugin intends to secure AJAX requests using nonces, specific code paths either skip this validation or expose these tokens to unauthenticated visitors, rendering the protection mechanism ineffective.\nThe impact is significant, as an attacker can disable the site's maintenance or coming-soon mode, effectively exposing private site content or ongoing development work to the public. Successful exploitation requires no authentication, allowing any remote visitor to manipulate the plugin's configuration via a crafted HTTP request. The risk is considered high due to the ease of exploitation and the potential for unauthorized exposure of sensitive site environments.",
  "technicalDetails": "The vulnerability resides within the CMP plugin's AJAX handler architecture. The root cause is twofold: a failure to perform mandatory capability checks (via current_user_can()) on a sensitive configuration-modifying AJAX action, and a reliance on a broken nonce validation process.\nIn the affected versions, certain code branches responsible for handling plugin settings do not verify the security nonce, while other branches expose the necessary nonces to anonymous users. This creates a scenario where an attacker can obtain valid nonce tokens through public-facing page source analysis or by interacting with non-protected AJAX endpoints.\nThe exploitation flow proceeds as follows: First, the attacker identifies the AJAX action responsible for toggling the 'maintenance' or 'coming-soon' mode. Second, if a nonce is required, the attacker retrieves it from the publicly exposed JavaScript variables or specific HTML fragments that the plugin leaks to the frontend. Third, the attacker constructs a POST request to the WordPress 'admin-ajax.php' endpoint, supplying the target action and the discovered nonce. Because the backend fails to validate the authorization level of the requester, the plugin executes the function call.\nSpecifically, under non-default countdown configurations, the internal logic for state management is triggered. The lack of strict access control means that the server-side callback processes the request as if it were an authorized administrator request. The plugin subsequently updates the database, setting the 'maintenance_mode' status to 'disabled' or modifying related configuration flags.\nThis vulnerability is particularly impactful because it bypasses the security-through-obscurity provided by the 'coming-soon' mode, which is frequently used to protect sensitive site data during development or staging phases. Post-exploitation, the attacker achieves complete control over the site's public visibility state without needing any administrative credentials or elevated privileges on the WordPress installation."
}