CVE-2022-50955: Curtain

Medium severity, CVSS 4.3. EPSS: 0.1% chance of exploitation in the next 30 days.

WordPress Plugin Curtain 1.0.2 contains a cross-site request forgery vulnerability that allows attackers to activate or deactivate site maintenance mode by crafting malicious requests. Attackers can trick authenticated administrators into submitting forged requests to the options-general.php page with curtain parameters to toggle maintenance mode without valid nonce validation.

Affected products

• Curtain Curtain: version 1.0.2 only

Published 2026-05-10. Last modified 2026-07-24.