Medium severity · published Oct 21, 2026
CVE-2026-101138
CMP - Coming Soon & Maintenance 4.1.19 - 4.1.20 - Unauthenticated Maintenance Mode Bypass via Custom URL Whitelist
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 does not correctly apply maintenance mode to pages added to its page whitelist by manually entered URL pattern, allowing unauthenticated visitors to view the content of those pages while maintenance mode is active.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
CMP – Coming Soon & Maintenance ·
4.1.19 before 4.1.21 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-101138
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-101138
wpscan.com
https://wpscan.com/vulnerability/ae9f4fa9-e17d-4c52-86c8-48e5ba0dfef8/
More from CMP – Coming Soon & Maintenance
5.3
CVE-2026-13413
CMP - Coming Soon & Maintenance < 4.1.20 - Unauthenticated Maintenance Mode Bypass via Login URL Match