---
id: "CVE-2026-101138"
kind: "vulnerability"
aliases: ["CVE-2026-101138"]
title: "WordPress CMP maintenance plugin leaks whitelisted pages to visitors"
severity: "medium"
cvss: 5.3
epss: 0.00187
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wordpress-plugin"]
not_affected_if: ["maintenance-mode-off", "no-manual-whitelist", "plugin-updated"]
published_at: "2026-10-21T09:17:05+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T04:21:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101138", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-101138", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# WordPress CMP maintenance plugin leaks whitelisted pages to visitors

The CMP Coming Soon & Maintenance WordPress plugin before 4.1.21 does not apply maintenance mode to pages added to its whitelist by manually entered URL pattern. Unauthenticated visitors can read the content of those pages while maintenance mode is active.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin Plugins screen, or with `wp plugin get cmp-coming-soon-maintenance --field=version` (slug unknown: confirm from the plugin directory)
- In the plugin settings, look for a whitelist of URL patterns under maintenance mode and see whether any manually entered patterns are in use

## Fix

- Update the CMP – Coming Soon & Maintenance plugin to `4.1.21` or later
- If an update is not possible, disable maintenance mode or remove manually entered whitelist URL patterns until updated

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101138
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-101138

## From the sources

The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 does not correctly apply maintenance mode to pages added to its page whitelist by manually entered URL pattern, allowing unauthenticated visitors to view the content of those pages while maintenance mode is active.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_