Unauthenticated Settings Reset in Coming Soon Page & Maintenance Mode Plugin by WordPress
CVE-2019-25139

6.5MEDIUM

Key Information:

Vendor
Wordpress
Status
Coming Soon Page & Maintenance Mode
Vendor
CVE Published:
7 June 2023

Summary

The Coming Soon Page & Maintenance Mode plugin for WordPress exposes a vulnerability allowing unauthenticated attackers to reset plugin settings. This flaw arises from inadequate capability checks within the data-reset-post.php file, affecting versions up to and including 1.8.1. Without proper authentication, malicious users can exploit this weakness to change settings, potentially leading to unauthorized access or disruption of the site functionality.

Affected Version(s)

Coming Soon Page & Maintenance Mode * <= 1.8.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://blog.nintechnet.com/unauthenticated-stored-xss-in...
https://plugins.trac.wordpress.org/changeset/2121321

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jerome Bruandet
.