CVE-2019-25139mediumCWE-862

CVE-2019-25139: medium-severity vulnerability in wpshopmart Coming Soon Page & Maintenance Mode

Coming Soon Page & Maintenance Mode <= 1.8.1 - Unauthenticated Settings Reset

Published · Updated

Follow this CVE+ Monitor Coming Soon Page & Maintenance Mode

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.8%
The Coming Soon Page & Maintenance Mode plugin for WordPress is vulnerable to unauthenticated settings reset in versions up to, and including 1.8.1 due to missing capability checks in the ~/functions/data-reset-post.php file which makes it possible for unauthenticated attackers to trigger a plugin settings reset.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Affected products
wpshopmart · Coming Soon Page & Maintenance Mode
Related CVEs — wpshopmart Coming Soon Page & Maintenance Mode

In the same product, most dangerous first.

CVE-2019-25140HIGHComing Soon Page & Maintenance Mode <= 1.8.1 - Stored Cross Site ScriptingEPSS 0.8%CVE-2024-1136MEDIUMComing Soon Page & Maintenance Mode <= 2.2.1 - Maintenance Mode BypassEPSS 0.5%