CVE-2026-13414 Overview
CVE-2026-13414 affects the CMP (Coming Soon & Maintenance Plugin) for WordPress in versions prior to 4.1.18. The plugin fails to perform authorization checks on one of its AJAX actions. It also relies on a nonce that is skipped for certain requests and exposed to anonymous visitors on others. This allows unauthenticated attackers to disable the site's maintenance or coming-soon mode when a non-default countdown configuration is in use.
Critical Impact
Unauthenticated attackers can remotely disable maintenance mode on affected WordPress sites, exposing under-construction or restricted content to the public internet.
Affected Products
- CMP (Coming Soon & Maintenance Plugin) for WordPress versions before 4.1.18
- WordPress sites using CMP with non-default countdown configuration
- Any WordPress installation relying on CMP to gate pre-launch or maintenance content
Discovery Timeline
- 2026-08-27 - CVE-2026-13414 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-13414
Vulnerability Analysis
The vulnerability is a Broken Access Control flaw in the CMP WordPress plugin's AJAX handler. The plugin registers an AJAX action available to both authenticated and unauthenticated users. The handler does not verify the requester's capabilities before performing state-changing operations. As a result, any anonymous visitor can invoke the action and toggle the plugin's maintenance state.
The secondary defense — a WordPress nonce — is ineffective in this code path. The nonce check is skipped for certain requests. In other cases the nonce value is rendered in output that anonymous visitors can retrieve. An attacker who reads the exposed nonce can then satisfy the check without holding a valid session.
Exploitation requires the site to use a non-default countdown configuration. When this condition is met, an attacker can send a crafted AJAX request that disables maintenance or coming-soon mode. This exposes the underlying WordPress site, which may contain unfinished content, staging data, or unpublished pages.
Root Cause
The root cause is Missing Authorization combined with an improperly scoped nonce check. The AJAX action lacks a current_user_can() capability check. The nonce is either bypassed in the handler or leaked in a location accessible to unauthenticated visitors, defeating its intended CSRF protection.
Attack Vector
The attack is network-based and requires no authentication or user interaction. An attacker sends an HTTP request to the WordPress admin-ajax.php endpoint targeting the vulnerable CMP AJAX action. If the site runs a non-default countdown configuration, the request succeeds and disables maintenance mode. See the WPScan Vulnerability Report for the detailed technical write-up.
Detection Methods for CVE-2026-13414
Indicators of Compromise
- Unexpected disabling of maintenance or coming-soon mode without an administrator action in the audit log
- Anonymous POST requests to /wp-admin/admin-ajax.php targeting CMP plugin actions
- Public accessibility of pages that were previously gated by the CMP plugin
Detection Strategies
- Inventory WordPress installations and identify sites running CMP versions prior to 4.1.18
- Review web server access logs for admin-ajax.php requests referencing CMP action names from unauthenticated sources
- Monitor plugin option changes in the wp_options table that toggle CMP's active state
Monitoring Recommendations
- Enable WordPress activity logging to capture plugin setting changes and option updates
- Alert on external HTTP 200 responses to admin-ajax.php from clients without valid session cookies
- Track public availability of the site root and compare against expected maintenance-mode responses
How to Mitigate CVE-2026-13414
Immediate Actions Required
- Update the CMP plugin to version 4.1.18 or later on all WordPress installations
- Audit whether maintenance or coming-soon mode has been disabled unexpectedly and re-enable it if needed
- Restrict access to wp-admin/admin-ajax.php from untrusted networks where feasible
Patch Information
The vendor addressed the issue in CMP version 4.1.18 by enforcing authorization checks on the affected AJAX action and correcting the nonce handling. Refer to the WPScan Vulnerability Report for advisory details and the fixed version.
Workarounds
- Deactivate the CMP plugin until it can be upgraded to 4.1.18 or later
- Switch the plugin away from the non-default countdown configuration required to trigger the flaw
- Place the site behind an authentication proxy or IP allow-list during pre-launch or maintenance windows
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
