CVE-2024-1472: WP Maintenance Information Disclosure Flaw

CVE-2024-1472 Overview

CVE-2024-1472 is an information exposure vulnerability affecting the WP Maintenance plugin for WordPress. All versions up to and including 6.1.6 fail to restrict access to post and page content through the WordPress REST API. Unauthenticated remote attackers can bypass the plugin's maintenance mode and retrieve site content that should be hidden from public view.

The issue is tracked under CWE-284: Improper Access Control. It was published to the National Vulnerability Database (NVD) on February 29, 2024, and affects the restezconnectes/wp_maintenance plugin distributed through the WordPress plugin repository.

Critical Impact
Unauthenticated attackers can bypass maintenance mode and read draft, unpublished, or under-development post and page content through unauthenticated REST API requests.

Affected Products

WP Maintenance plugin (restezconnectes/wp_maintenance) versions up to and including 6.1.6
WordPress sites relying on WP Maintenance to conceal in-progress content
Any deployment exposing the /wp-json/wp/v2/ REST API endpoints while in maintenance mode

Discovery Timeline

2024-02-29 - CVE-2024-1472 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1472

Vulnerability Analysis

The WP Maintenance plugin restricts front-end browsing while a site is under construction or being updated. The plugin intercepts standard page loads and returns a maintenance splash to visitors. However, the access control logic does not extend to the WordPress REST API surface. Requests to endpoints such as /wp-json/wp/v2/posts and /wp-json/wp/v2/pages continue to return published content data as if maintenance mode were disabled.

Because the REST API remains reachable without authentication, adversaries can enumerate site content, harvest metadata, and read the body of posts and pages that operators believed were shielded. The impact is limited to confidentiality, but the disclosure can include draft messaging, unreleased product information, or internal notes that leak during pre-launch phases.

Root Cause

The root cause is improper access control [CWE-284]. The plugin enforces maintenance-mode gating only on standard page rendering paths. It does not register a rest_authentication_errors filter or equivalent REST permission callback to reject or redirect unauthenticated REST requests when maintenance mode is active. The default WordPress REST endpoints therefore serve public post and page content unchanged.

Attack Vector

Exploitation requires no authentication, no user interaction, and no elevated privileges. An attacker sends a standard HTTP GET request to a REST endpoint such as /wp-json/wp/v2/posts or /wp-json/wp/v2/pages against a target site running a vulnerable version of the plugin. The server responds with a JSON payload containing post and page content, bypassing the maintenance splash entirely. The attack is scriptable and works across the network against any exposed WordPress site.

No verified public proof-of-concept code is available. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-1472

Indicators of Compromise

Unauthenticated HTTP GET requests to /wp-json/wp/v2/posts, /wp-json/wp/v2/pages, or related core REST routes while the site is in maintenance mode
Access log entries showing successful 200 OK REST API responses from external IPs during scheduled maintenance windows
Repeated enumeration patterns iterating through ?page= and ?per_page= query parameters against REST endpoints

Detection Strategies

Inventory WordPress installations and identify sites running WP Maintenance at version 6.1.6 or earlier
Compare the volume of REST API traffic against expected baselines during maintenance-mode intervals
Correlate front-end maintenance-page requests with concurrent REST API access from the same client IPs to identify bypass attempts

Monitoring Recommendations

Forward WordPress access logs and web application firewall (WAF) events to a centralized logging platform for query and retention
Alert on unauthenticated REST API responses that return post or page body content while maintenance mode is enabled
Track plugin version drift across managed WordPress fleets to identify hosts still running vulnerable releases

How to Mitigate CVE-2024-1472

Immediate Actions Required

Upgrade the WP Maintenance plugin to a version later than 6.1.6 that addresses the REST API bypass
Audit REST API access logs for the period during which maintenance mode was active on affected sites
Remove or unpublish sensitive draft content from sites that rely solely on the plugin to enforce confidentiality

Patch Information

The vendor addressed the issue in a plugin update tracked in the WordPress Plugin Changeset. Site administrators should apply the update through the WordPress plugin manager or via wp-cli. Confirm the installed version after upgrade to verify remediation.

Workarounds

Disable the WordPress REST API for unauthenticated users using a rest_authentication_errors filter until the plugin is patched
Place the site behind HTTP Basic authentication or an IP allowlist at the web server or reverse proxy layer during maintenance windows
Deploy WAF rules that block or challenge unauthenticated requests to /wp-json/wp/v2/posts and /wp-json/wp/v2/pages while maintenance mode is active

bash

# Update the WP Maintenance plugin via wp-cli
wp plugin update wp-maintenance

# Verify the installed version is above 6.1.6
wp plugin get wp-maintenance --field=version