Vulnerability · Published Sep 19, 2022 · Assigned by WPScan
CVE-2022-1580Site Offline < 1.5.3 - Access Bypass
Medium 4.3
In plain English
A medium-severity authorization bypass via user-controlled key in Site Offline Or Coming Soon Or Maintenance Mode from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS NVD)4.3Medium
Exploit odds (30 days)1.6%top 24.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei
Official description
The Site Offline Or Coming Soon Or Maintenance Mode WordPress plugin before 1.5.3 prevents users from accessing a website but does not do so if the URL contained certain keywords. Adding those keywords to the URL's query string would bypass the plugin's main feature.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Site Offline Or Coming Soon Or Maintenance Mode | 1.5.3 – before 1.5.3 |
Weakness: CWE-639