---
id: CVE-2026-101138
title: >-
  CMP - Coming Soon & Maintenance 4.1.19 - 4.1.20 - Unauthenticated Maintenance
  Mode Bypass via Custom URL Whitelist
summary: >-
  The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 does not
  correctly apply maintenance mode to pages added to its page whitelist by
  manually entered URL pattern, allowing unauthenticated visitors to view the
  content of t…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-284
product: CMP – Coming Soon & Maintenance
affected:
  - cmp_coming_soon_maintenance >= 4.1.19 < 4.1.21
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-21T10:12:15.447848Z'
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T10:14:55.768Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-101138'
references:
  - url: 'https://wpscan.com/vulnerability/ae9f4fa9-e17d-4c52-86c8-48e5ba0dfef8/'
tags:
  - cve.org
ingestedAt: '2026-10-21T09:46:15.401Z'
---

## Overview

The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 does not correctly apply maintenance mode to pages added to its page whitelist by manually entered URL pattern, allowing unauthenticated visitors to view the content of those pages while maintenance mode is active.

## Affected

- `cmp_coming_soon_maintenance >= 4.1.19 < 4.1.21`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.