Coming Soon & Maintenance Mode by Colorlib <= 1.4.0 - Unauthenticated Sensitive Information Exposure via Comment Form Redirect
- ID
- WPSEC-2026-0140
- Plugin
- Coming Soon & Maintenance Mode by Colorlib (colorlib-coming-soon-maintenance)
- Affected
- all versions before 1.4.1
- Remediation
- Update to 1.4.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Coming Soon & Maintenance Mode by Colorlib on WPSec AttackSurface
- Fix released
- Published
Description
The Coming Soon & Maintenance Mode by Colorlib plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.0. While the coming soon or maintenance page was active, the plugin closed the REST API, XML-RPC, wp-links-opml.php and logged-out admin-ajax.php, but not wp-comments-post.php or wp-trackback.php, and a successful comment submission redirects to the target post's permalink. This makes it possible for unauthenticated attackers to submit a comment against a post ID and learn the URL (slug) of any published post that accepts comments, content the coming soon or maintenance mode is meant to hide, as well as to post comments and trackbacks while the site is closed.
References
- https://wpsec.com/vuln/WPSEC-2026-0140/
- https://plugins.svn.wordpress.org/colorlib-coming-soon-maintenance/tags/1.4.1/
- https://wordpress.org/plugins/colorlib-coming-soon-maintenance/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS