CVE-2024-1136: WordPress Coming Soon Plugin Auth Bypass Flaw

CVE-2024-1136 Overview

CVE-2024-1136 affects the Coming Soon Page & Maintenance Mode plugin for WordPress, developed by wpshopmart. The vulnerability stems from an improperly implemented URL check in the wpsm_coming_soon_redirect function. All plugin versions up to and including 2.2.1 are affected. Unauthenticated attackers can view content on sites configured with maintenance mode or coming-soon mode enabled. The flaw is classified as a Missing Authorization issue [CWE-862] and exposes site content that administrators intended to keep hidden from public visitors during pre-launch or maintenance windows.

Critical Impact

Unauthenticated remote attackers can bypass the maintenance-mode redirect and read protected site content, undermining the plugin's core access control purpose.

Affected Products

• wpshopmart Coming Soon Page & Maintenance Mode plugin for WordPress (all versions ≤ 2.2.1)
• WordPress installations using the responsive-coming-soon plugin slug
• Sites relying on the plugin to gate pre-launch or under-construction content

Discovery Timeline

• 2024-02-28 - CVE-2024-1136 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1136

Vulnerability Analysis

The Coming Soon Page & Maintenance Mode plugin enforces its access restriction through the wpsm_coming_soon_redirect function defined in redirect.php. This function evaluates the request URL and decides whether to redirect visitors to the maintenance splash page. The implementation performs an incomplete URL comparison. Attackers can craft requests that fail the intended check and reach the underlying site content directly.

Because the plugin is the sole gate between anonymous visitors and hidden site pages, this logic flaw defeats the plugin's entire purpose. The vulnerability requires no authentication, no user interaction, and no elevated privileges. Impact is limited to confidentiality; integrity and availability are not affected. The condition maps to Missing Authorization [CWE-862].

Root Cause

The root cause is an insufficient URL validation routine in wpsm_coming_soon_redirect. The function does not correctly identify every request path that should be intercepted and redirected. Requests that do not match the narrow allowlist logic bypass the redirect and reach the WordPress content-rendering pipeline. See the WordPress Plugin Code Review for the affected source line.

Attack Vector

Exploitation occurs over the network against any WordPress site running a vulnerable plugin version with maintenance or coming-soon mode enabled. An unauthenticated attacker sends HTTP requests crafted to evade the URL check. The server returns the hidden content rather than the maintenance page. Refer to the Wordfence Vulnerability Report for additional technical detail. No public proof-of-concept or Exploit-DB entry is currently associated with this CVE.

Detection Methods for CVE-2024-1136

Indicators of Compromise

• Anonymous HTTP GET requests that successfully return non-maintenance page content while the plugin is set to maintenance or coming-soon mode.
• Web-server access logs showing 200 responses to unauthenticated requests for pages, posts, or media that should have been redirected.
• Requests targeting unusual query strings, trailing slashes, or path variations designed to bypass the redirect check.

Detection Strategies

• Inventory WordPress sites and enumerate installed plugin versions, flagging any responsive-coming-soon installation at version 2.2.1 or earlier.
• Compare expected redirect behavior against actual server responses using synthetic monitoring against protected URLs.
• Correlate access-log anomalies against WordPress plugin status to identify content being served during declared maintenance windows.

Monitoring Recommendations

• Ingest WordPress and web-server logs into a centralized analytics platform and alert on 200-status responses to unauthenticated requests during maintenance windows.
• Baseline normal request patterns for maintenance-gated sites and alert on deviations that indicate redirect bypass attempts.
• Track plugin update status across the WordPress estate and generate exceptions when vulnerable versions remain in production.

How to Mitigate CVE-2024-1136

Immediate Actions Required

• Update the Coming Soon Page & Maintenance Mode plugin to the latest version available from the WordPress plugin repository.
• Audit all WordPress sites for the responsive-coming-soon plugin and confirm the running version is greater than 2.2.1.
• Treat maintenance-mode as a soft control, not a security boundary; remove any sensitive content from sites that rely solely on this plugin.

Patch Information

Apply the vendor-supplied update published through the WordPress plugin repository. Refer to the Wordfence Vulnerability Report for fixed-version details and validation guidance.

Workarounds

• Restrict access to the WordPress site at the web-server or WAF layer using IP allowlisting until the plugin is updated.
• Enforce HTTP basic authentication in front of the site during pre-launch phases to prevent anonymous content access.
• Temporarily take the site offline or serve a static maintenance page from the web server rather than relying on plugin-level redirection.

# Example: Nginx allowlist for pre-launch maintenance
location / {
    allow 203.0.113.0/24;   # trusted office range
    deny  all;
    try_files $uri $uri/ /index.php?$args;
}