CVE-2026-13414CWE-862broken-access-control

CVE-2026-13414

Medium · published August 27, 2026

CVSS v3.1

4.8

EPSS

Percentile

3.2

In the wild

Unconfirmed

What it is

The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain (and exposed to anonymous visitors on others), allowing unauthenticated attackers to disable the site's maintenance/coming-soon mode under a non-default countdown configuration.

The record

Technical detail

CVSS v3.1: 4.8 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00142 · 3.2th percentile
Weakness: CWE-862 · Missing Authorization
Published: 2026-08-27T10:16Z

References (1)

https://wpscan.com/vulnerability/096f11ce-060a-403a-8af0-ae2ee7676318/ · [email protected]

EPSS history

Timeline

28 AUG 06:30Z
EPSS moved — → 0%
epss
27 AUG 06:00Z
CMP - Coming Soon & Maintenance < 4.1.18 - Unauthenticated Maintenance Mode Disable via cmp_disable_comingsoon_ajax
cvelistv5