CVE-2026-101138 CMP – Coming Soon & Maintenance CVE debrief

Who should care

Defenders responsible for WordPress sites using the CMP – Coming Soon & Maintenance plugin, specifically versions 4.1.19 and 4.1.20, should assess exposure and prioritize verification and potential upgrades.

Why it matters

The CVE-2026-101138 vulnerability in the CMP – Coming Soon & Maintenance WordPress plugin allows unauthenticated visitors to bypass maintenance mode and access whitelisted pages. Defenders should prioritize verifying exposure, assessing the need for upgrades, and monitoring for potential unauthorized access.

• Potential unauthorized access to sensitive information on whitelisted pages
• Bypass of maintenance mode, allowing visitors to access pages that should be restricted
• Possible impact on site security and data confidentiality

Technical summary

The CMP – Coming Soon & Maintenance WordPress plugin before version 4.1.21 does not correctly apply maintenance mode to pages added to its page whitelist by manually entered URL pattern. This allows unauthenticated visitors to view the content of those pages while maintenance mode is active. The vulnerability has a CVSS score of 5.3 and a severity of MEDIUM. Defenders should prioritize verifying exposure of WordPress sites using the CMP – Coming Soon & Maintenance plugin, versions 4.1.19 and 4.1.20, and assess the need for an upgrade to version 4.1.21 or later.

Defensive priority

Defenders should prioritize verifying exposure of WordPress sites using the CMP – Coming Soon & Maintenance plugin, versions 4.1.19 and 4.1.20, and assess the need for an upgrade to version 4.1.21 or later.

Recommended defensive actions

• Verify WordPress sites using CMP – Coming Soon & Maintenance plugin, versions 4.1.19 and 4.1.20, for potential exposure
• Assess the need for an upgrade to version 4.1.21 or later
• Monitor for potential unauthorized access to whitelisted pages
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information about the vulnerability. A supplemental source reference from WPScan offers additional technical details. The vulnerability has been verified by multiple sources, and defenders should review the official advisory for affected scope, severity, and vendor guidance. The CVE record was published on 2026-10-21T08:38:55.566Z and has not been modified since then. The vulnerability affects WordPress sites using the CMP – Coming Soon & Maintenance plugin, versions

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.