Security Alert Summary
The CMP WordPress plugin before version 4.1.18 contains an authorization issue in one of its AJAX actions. The plugin relies on a nonce that can be skipped or exposed to anonymous visitors in some cases, allowing unauthenticated attackers to disable a sites maintenance/coming-soon mode when a non-default countdown configuration is in use.
CVE Details
- CVE ID: CVE-2026-13414
- Affected component: CMP WordPress plugin
- Affected versions: versions before 4.1.18 (less than 4.1.18)
- Published: August 27, 2026 at 06:16:55 AM
- Last modified: August 27, 2026 at 06:16:55 AM
- CVSS v3.1 base score / severity / vector: Not provided in the JSON
- Authentication / privileges / user interaction: Not provided in CVSS data; the description indicates the issue can be triggered by unauthenticated attackers due to missing authorization checks and nonce handling
- Primary impact:
- Confidentiality: Potential exposure of content that would otherwise be hidden during maintenance/coming-soon mode
- Integrity: No direct integrity impact indicated in the provided data
- Availability: Changes to maintenance/coming-soon state could affect site availability or public access timing
- CWE / weakness ID: Not provided in the JSON
Technical Details
According to the supplied description, the vulnerability exists because the plugin does not perform proper authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain requests and exposed to anonymous visitors for others. This combination allows an attacker without valid authentication to invoke the affected AJAX action and disable the sites maintenance/coming-soon mode when the site uses a non-default countdown configuration.
No specific function names, REST API endpoints, or code references were provided in the JSON, so the technical assessment is limited to the described missing authorization check and improper nonce handling. The practical impact is that the intended gate that prevents public access during maintenance can be bypassed, exposing content that the site owner intended to block until maintenance is complete.
How This Could Impact Your Website
Consider a small team running a WordPress site with a site owner, an internal marketer who schedules updates, and an external contractor handling design changes. If maintenance or coming-soon mode is used to hide in-progress changes, an attacker exploiting this issue could re-enable public access prematurely. That may expose unpublished content or internal notices to visitors and increase the risk of targeted phishing or social engineering against staff whose information becomes visible.
This does not imply an attacker can modify other site data or gain administrator access based on the provided description, but it does mean the protective maintenance barrier can be bypassed under the specified conditions. If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available (versions before 4.1.18 are affected).
- Review and reduce unnecessary user roles, especially contributor-level accounts and other low-privilege roles that can interact with front-end features.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and access logs for unusual behavior around maintenance or coming-soon pages.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team is happy to help.
