Cross-Site Request Forgery Vulnerability in Coming Soon & Maintenance Mode Page Plugin for WordPress
CVE-2020-36707

8.8HIGH

Key Information:

Vendor
Wordpress
Status
Coming Soon & Maintenance Mode Page
Vendor
CVE Published:
7 June 2023

Summary

The Coming Soon & Maintenance Mode Page plugin for WordPress is impacted by a Cross-Site Request Forgery vulnerability. This flaw results from improper nonce validation due to confusing logic functions, allowing unauthenticated attackers to execute unauthorized actions. Such actions require tricking a site administrator into clicking on a malicious link, which can compromise the site's integrity. Users are encouraged to update to the latest version to mitigate this risk.

Affected Version(s)

Coming Soon & Maintenance Mode Page * <= 1.57

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://jetpack.com/features/security/library/nifty-comin...
https://wpscan.com/vulnerability/aa47a464-af97-43bc-b6cb-...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jerome Bruandet
.