Cross-Site Request Forgery Vulnerability in Coming Soon & Maintenance Mode Page WordPress Plugin

CVE-2020-36752

Summary

The Coming Soon & Maintenance Mode Page plugin for WordPress is affected by a Cross-Site Request Forgery vulnerability present in versions up to and including 1.57. This vulnerability arises from improper nonce validation in the save_meta_box() function. If exploited, it allows unauthenticated attackers to manipulate meta boxes by tricking site administrators into making unintended actions, such as clicking on a malicious link. This could compromise the integrity of the affected WordPress sites, highlighting the critical need for plugin updates and secure coding practices to prevent exploitation.

References