CVE-2023-2159: Niteothemes Cmp

Medium severity, CVSS 5.3. EPSS: 0.8% chance of exploitation in the next 30 days.

The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Maintenance Mode Bypass in versions up to, and including, 4.1.7. A correct cmp_bypass GET parameter in the URL (equal to the md5-hashed home_url in the default setting) allows users to visit a site placed in maintenance mode thus bypassing the plugin's provided feature.

Affected products

• Niteothemes Cmp: before 4.1.8 (fixed in 4.1.8)

Published 2023-06-09. Last modified 2026-06-17.