[ CVE-2026-13413 · Published 2 Oct 2026 ]
Vulnerability in Unknown CMP – Coming Soon & Maintenance
CVSS 5.3
EPSS <1%No fix listed yet
[ Description ]Official description
The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.20 does not correctly restrict access to the site while maintenance/coming-soon mode is enabled, allowing unauthenticated visitors to bypass the coming-soon page and reach the otherwise hidden site, including hidden published pages, by shaping the request so it is mistaken for a login request.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.