PT-2023-16847 · WordPress · Cmp – Coming Soon & Maintenance Plugin

Marco Wotschka · Published 2023-03-07 · Updated 2023-03-14 · CVE-2023-1263

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions CMP – Coming Soon & Maintenance plugin for WordPress versions up to, and including, 4.1.6

Description The issue allows unauthenticated individuals to obtain the contents of any non-password-protected, published post or page even when maintenance mode is enabled. This is achieved via the cmp get post detail function.

Recommendations For versions up to, and including, 4.1.6, consider disabling the cmp get post detail function until a patch is available to prevent information exposure.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2023-1263

Affected Products

Cmp – Coming Soon & Maintenance Plugin

References · 6

• https://osv.dev/vulnerability/CVE-2023-1263 · Vendor Advisory
• https://plugins.trac.wordpress.org/browser/cmp-coming-soon-maintenance/tags/4.1.6/niteo-cmp.php#L2759 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-1263 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/e01b4259-ed8d-44a4-9771-470de45b14a8?source=cve · Note
• https://t.me/cibsecurity/59637 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/e01b4259-ed8d-44a4-9771-470de45b14a8 · Note