CVE-2026-13413: Unknown Cmp – Coming Soon & Maintenance

Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.20 does not correctly restrict access to the site while maintenance/coming-soon mode is enabled, allowing unauthenticated visitors to bypass the coming-soon page and reach the otherwise hidden site, including hidden published pages, by shaping the request so it is mistaken for a login request.

Affected products

• Unknown Cmp – Coming Soon & Maintenance: before 4.1.20 (fixed in 4.1.20)

Published 2026-10-02. Last modified 2026-10-02.