The WP Maintenance Mode & Coming Soon WordPress plugin before 2.4.5 is lacking CSRF when emptying the subscribed users list, which could allow attackers to make a logged in admin perform such action via a CSRF attack
CPE | Name | Operator | Version |
---|---|---|---|
wp_maintenance_mode_\\&_coming_soon | lt | 2.4.5 |