CVE-2024-1075

The Minimal Coming Soon – Coming Soon Page plugin for WordPress is vulnerable to maintenance mode bypass and information disclosure in all versions up to, and including, 2.37. This is due to the plugin improperly validating the request path. This makes it possible for unauthenticated attackers to bypass maintenance mode and view pages that should be hidden.
Configurations

Configuration 1 (hide)

cpe:2.3:a:webfactoryltd:minimal_coming_soon_\&_maintenance_mode:*:*:*:*:*:wordpress:*:*

History

13 Feb 2024, 19:43

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 3.7
v2 : unknown
v3 : 5.3
CPE cpe:2.3:a:webfactoryltd:minimal_coming_soon_\&_maintenance_mode:*:*:*:*:*:wordpress:*:*
First Time Webfactoryltd minimal Coming Soon \& Maintenance Mode
Webfactoryltd
References () https://plugins.trac.wordpress.org/browser/minimal-coming-soon-maintenance-mode/trunk/framework/public/init.php#L67 - () https://plugins.trac.wordpress.org/browser/minimal-coming-soon-maintenance-mode/trunk/framework/public/init.php#L67 - Product
References () https://plugins.trac.wordpress.org/changeset/3031149/minimal-coming-soon-maintenance-mode/trunk/framework/public/init.php - () https://plugins.trac.wordpress.org/changeset/3031149/minimal-coming-soon-maintenance-mode/trunk/framework/public/init.php - Patch
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/78203b98-15bc-4d8e-9278-c472b518be07?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/78203b98-15bc-4d8e-9278-c472b518be07?source=cve - Third Party Advisory
CWE NVD-CWE-noinfo
Summary
  • (es) El complemento Minimal Coming Soon – Coming Soon Page para WordPress es vulnerable a la omisión del modo de mantenimiento y a la divulgación de información en todas las versiones hasta la 2.37 incluida. Esto se debe a que el complemento validó incorrectamente la ruta de la solicitud. Esto hace posible que atacantes no autenticados omitan el modo de mantenimiento y vean páginas que deberían estar ocultas.

05 Feb 2024, 22:16

Type Values Removed Values Added
New CVE

Information

Published : 2024-02-05 22:16

Updated : 2024-02-13 19:43


NVD link : CVE-2024-1075

Mitre link : CVE-2024-1075

CVE.ORG link : CVE-2024-1075


JSON object : View

Products Affected

webfactoryltd

  • minimal_coming_soon_\&_maintenance_mode