CVE-2026-111034 · Package
NO FIX YET
The Countdown, Coming Soon, Maintenance WordPress plugin through 3.0.8 has an AJAX action that returns post titles without checking the user's permission. Any logged-in user, including a subscriber, can list titles of published posts of any type, but not drafts, private or pending content.
first public Nov 14, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the Countdown, Coming Soon, Maintenance plugin through 3.0.8 that allow user registration or have subscriber accounts. Exposure is limited to titles of published entries; sites without open registration or without this plugin can skip it.
Not affected if no-public-registration, plugin-not-installed
Who cares self-hosted, wordpress
3.0.8 or lower in the WordPress admin Plugins page or wp plugin listNo fix yet, per the sources.
The Countdown, Coming Soon, Maintenance WordPress plugin through 3.0.8 does not check that the user is allowed to browse content before returning post titles from one of its AJAX actions, allowing any authenticated user, such as a subscriber, to list the titles of published entries of any post type, including types that WordPress does not expose to them. Draft, private and pending content is not returned; only published entries are disclosed.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.