Vulnerability · Published Oct 2, 2026 · Assigned by WPScan

CVE-2026-13413CMP - Coming Soon & Maintenance < 4.1.20 - Unauthenticated Maintenance Mode Bypass via Login URL Match

Medium 5.3

In plain English

A medium-severity improper access control in CMP – Coming Soon & Maintenance from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.2%top 84.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.20 does not correctly restrict access to the site while maintenance/coming-soon mode is enabled, allowing unauthenticated visitors to bypass the coming-soon page and reach the otherwise hidden site, including hidden published pages, by shaping the request so it is mistaken for a login request.

Affected products (as reported)

Vendor	Product	Versions
Unknown	CMP – Coming Soon & Maintenance	0 – before 4.1.20

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://wpscan.com/vulnerability/706afdef-4935-44d9-ab09-68c80f3bfef9/ exploit, vdb-entry, technical-description