{"id":"CVE-2026-101138","kind":"vulnerability","aliases":["CVE-2026-101138"],"related":[],"title":"WordPress CMP maintenance plugin leaks whitelisted pages to visitors","description":"The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 does not correctly apply maintenance mode to pages added to its page whitelist by manually entered URL pattern, allowing unauthenticated visitors to view the content of those pages while maintenance mode is active.","summary":"The CMP Coming Soon & Maintenance WordPress plugin before 4.1.21 does not apply maintenance mode to pages added to its whitelist by manually entered URL pattern. Unauthenticated visitors can read the content of those pages while maintenance mode is active.","severity":"medium","cvss":5.3,"epss":0.00187,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["maintenance-mode-off","no-manual-whitelist","plugin-updated"],"how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen, or with `wp plugin get cmp-coming-soon-maintenance --field=version` (slug unknown: confirm from the plugin directory)\n- In the plugin settings, look for a whitelist of URL patterns under maintenance mode and see whether any manually entered patterns are in use","fix":"- Update the CMP – Coming Soon & Maintenance plugin to `4.1.21` or later\n- If an update is not possible, disable maintenance mode or remove manually entered whitelist URL patterns until updated","status":"open","published_at":"2026-10-21T09:17:05+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T04:21:06+00:00","updated_at":"2026-10-25T04:21:06+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:21:06Z","model":"claude-haiku-5-5","output":{"fix":"- Update the CMP – Coming Soon & Maintenance plugin to `4.1.21` or later\n- If an update is not possible, disable maintenance mode or remove manually entered whitelist URL patterns until updated","reach":"internet","title":"WordPress CMP maintenance plugin leaks whitelisted pages to visitors","impact":"low","summary":"The CMP Coming Soon & Maintenance WordPress plugin before 4.1.21 does not apply maintenance mode to pages added to its whitelist by manually entered URL pattern. Unauthenticated visitors can read the content of those pages while maintenance mode is active.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"anonymous visitors read content of whitelisted pages during maintenance","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen, or with `wp plugin get cmp-coming-soon-maintenance --field=version` (slug unknown: confirm from the plugin directory)\n- In the plugin settings, look for a whitelist of URL patterns under maintenance mode and see whether any manually entered patterns are in use","needs_analyst":false,"not_affected_if":["maintenance-mode-off","no-manual-whitelist","plugin-updated"],"who_is_affected":"Sites running the CMP plugin below 4.1.21 with maintenance mode enabled and at least one whitelisted page added by manual URL pattern are exposed, since those pages are readable by anonymous visitors. Sites without maintenance mode active, or without manual whitelist patterns, are not affected by this flaw.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000653,"input_tokens":3364,"output_tokens":634,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101138':12A,15A '-2026':11A,14A '4.1.21':32B,71C 'activ':62B,104C 'add':40B,80C 'allow':90C 'appli':35B,75C 'cmp':2A,25B,64C 'come':26B,65C 'content':54B,96C 'correct':74C 'cve':10A,13A 'enter':46B,87C 'host':19B 'leak':5A 'mainten':3A,28B,36B,59B,67C,76C,101C 'manual':45B,86C 'mode':37B,60B,77C,102C 'packag':16B 'page':7A,39B,57B,79C,83C,99C 'pattern':48B,89C 'plugin':4A,23B,30B,69C 'read':52B 'self':18B 'self-host':17B 'soon':27B,66C 'unauthent':49B,91C 'url':47B,88C 'view':94C 'visitor':9A,50B,92C 'whitelist':6A,43B,84C 'wordpress':1A,20B,22B,29B,68C 'wordpress-plugin':21B","nicknames":[],"mitigations":[],"who_affected":"Sites running the CMP plugin below 4.1.21 with maintenance mode enabled and at least one whitelisted page added by manual URL pattern are exposed, since those pages are readable by anonymous visitors. Sites without maintenance mode active, or without manual whitelist patterns, are not affected by this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T09:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101138","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101138","severity":null,"published_at":"2026-10-21T09:17:05+00:00","modified_at":"2026-10-21T18:37:38+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-101138","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101138","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}