Live › vulnerability › CVE-2026-101138
Go to dashboardThe CMP Coming Soon & Maintenance WordPress plugin before 4.1.21 does not apply maintenance mode to pages added to its whitelist by manually entered URL pattern. Unauthenticated visitors can read the content of those pages while maintenance mode is active.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the CMP plugin below 4.1.21 with maintenance mode enabled and at least one whitelisted page added by manual URL pattern are exposed, since those pages are readable by anonymous visitors. Sites without maintenance mode active, or without manual whitelist patterns, are not affected by this flaw.
No product ranges from the sources yet.
wp plugin get cmp-coming-soon-maintenance --field=version (slug unknown: confirm from the plugin directory)4.1.21 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 does not correctly apply maintenance mode to pages added to its page whitelist by manually entered URL pattern, allowing unauthenticated visitors to view the content of those pages while maintenance mode is active.
This page as .md · .json · in your agent: get_signal("CVE-2026-101138")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.