CVE-2026-101138: medium-severity vulnerability in CMP – Coming Soon & Maintenance
CMP - Coming Soon & Maintenance 4.1.19 - 4.1.20 - Unauthenticated Maintenance Mode Bypass via Custom URL Whitelist
Published
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3epss 0.3%
exploitation probability
0.3%top 83% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 does not correctly apply maintenance mode to pages added to its page whitelist by manually entered URL pattern, allowing unauthenticated visitors to view the content of those pages while maintenance mode is active.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Unknown · CMP – Coming Soon & Maintenancepublic PoCs found — 1
cve_referencewpscan.com/vulnerability/ae9f4fa9-e17d-4c52-86c8-48e5ba0dfef8/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — CMP – Coming Soon & Maintenance
In the same product, most dangerous first.