CVE-2023-2159 : The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Main

The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Maintenance Mode Bypass in versions up to, and including, 4.1.7. A correct cmp_bypass GET parameter in the URL (equal to the md5-hashed home_url in the default setting) allows users to visit a site placed in maintenance mode thus bypassing the plugin's provided feature.

Published 2023-06-09 06:16:04

Updated 2023-06-15 22:12:20

Source Wordfence

View at NVD, CVE.org

Vulnerability category: BypassGain privilege

Products affected by CVE-2023-2159

Niteothemes » CMP » For Wordpress
Versions before (<) 4.1.8
cpe:2.3:a:niteothemes:cmp:*:*:*:*:*:wordpress:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2023-2159

EPSS FAQ

0.14%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 31 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-2159

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4	Wordfence
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE ids for CVE-2023-2159

CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Assigned by: security@wordfence.com (Primary)

References for CVE-2023-2159

https://plugins.trac.wordpress.org/changeset/2900571/cmp-coming-soon-maintenance/tags/4.1.8/cmp-advanced.php?old=2873620&old_path=cmp-coming-soon-maintenance%2Ftags%2F4.1.7%2Fcmp-advanced.php

Diff from cmp-coming-soon-maintenance/tags/4.1.7/cmp-advanced.php@2873620 to cmp-coming-soon-maintenance/tags/4.1.8/cmp-advanced.php@2900571 – WordPress Plugin Repository
Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/af955f69-b18c-446e-b05e-6a57a5f16dfa?source=cve

CMP – Coming Soon & Maintenance <= 4.1.7 - Maintenance Mode Bypass
Third Party Advisory
https://plugins.trac.wordpress.org/browser/cmp-coming-soon-maintenance/tags/4.1.6/niteo-cmp.php#L808

niteo-cmp.php in cmp-coming-soon-maintenance/tags/4.1.6 – WordPress Plugin Repository
Exploit

Jump to

Vulnerability Details : CVE-2023-2159

Products affected by CVE-2023-2159

Exploit prediction scoring system (EPSS) score for CVE-2023-2159

CVSS scores for CVE-2023-2159

CWE ids for CVE-2023-2159

References for CVE-2023-2159