Unauthorized Modification of Data Vulnerability in Coming Soon & Maintenance Plugin

CVE-2024-9705

What is CVE-2024-9705?

The Ultimate Coming Soon & Maintenance plugin for WordPress has a security issue related to unauthorized data modification arising from a missing capability check in the 'ucsm_update_template_name_lite' function. This vulnerability allows authenticated attackers, even those with Subscriber-level access, to alter the names of templates used by the plugin. Affected versions include all releases up to and including 1.0.9. It is highly recommended for users of this plugin to review their installations and apply necessary updates to protect against potential exploitation.

References