Medium severity · published Dec 14, 2018
CVE-2018-20155
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated subscriber users to bypass intended access restrictions on changes to plugin settings
4.3
CVSS
0.8%
EPSS
No
On KEV
Description
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated subscriber users to bypass intended access restrictions on changes to plugin settings.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WM
WP Maintenance Mode · Designmodo
before 2.0.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-20155
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-20155
Third Party Advisory
https://www.wordfence.com/blog/2016/07/3-vulnerabilities-wp-maintenance-mode/
More from WP Maintenance Mode
7.2
CVE-2018-20156
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated "site administrator" users to execute arbitrary PHP code throughout a multisite network
4.3
CVE-2018-20154
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated users to discover all subscriber e-mail addresses