CVE-2026-13414

CMP - Coming Soon & Maintenance < 4.1.18 - Unauthenticated Maintenance Mode Disable via cmp_disable_comingsoon_ajax

The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain (and exposed to anonymous visitors on others), allowing unauthenticated attackers to disable the site's maintenance/coming-soon mode under a non-default countdown configuration.

We have discovered 672 live websites that are affected by CVE-2026-13414.

Run a Free Instant Scan



Affected Software

Product  Cmp Coming Soon Maintenance
Category Wordpress Plugins
Vulnerable Domains672 live websites (100% of Cmp Coming Soon Maintenance install base)
Vulnerable Versions
  • from 0 through 4.1.18
Vulnerable Versions Count27 versions ( 100% of all versions)


Common Weakness Enumeration

CWE-862 Missing Authorization



Details

  • Published - Aug 27, 2026
  • Updated - Aug 27, 2026

Credits

  • Revanth Hari Narayana Matte (finder)
  • WPScan (coordinator)

Website Distribution by Country

Number of websites using CVE-2026-13414
United States142 websites


Germany74 websites
GB49 websites
Italy49 websites
Russia47 websites
South Africa34 websites
Netherlands31 websites
France26 websites
Australia17 websites
Spain15 websites

Website Distribution by TLD

Number of websites using CVE-2026-13414
.com244 websites
.ru44 websites
.de38 websites
.it37 websites
.nl27 websites
.co.uk23 websites
.org23 websites
.fr13 websites
.net11 websites
.ch11 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-13414

Top websites that are affected by CVE-2026-13414. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
********************.com United States**,***
*********.***.ar Argentina***,***
************.com United States***,***
*********.com United States*,***,***
****.it Italy*,***,***
*************.de Germany*,***,***
*****************.com United States*,***,***
*****************.***.uk GB*,***,***
***.**********.ru Russia*,***,***
**********.***.br Brazil*,***,***
See full domain list

FAQ

CVE-2026-13414 is Missing Authorization in Cmp Coming Soon Maintenance
A total of 672 websites have been identified as vulnerable to CVE-2026-13414, based on global website indexing conducted by WebTechSurvey.
The Cmp Coming Soon Maintenance is affected by the CVE-2026-13414 vulnerability.
Cmp Coming Soon Maintenance versions up to 4.1.18 are vulnerable to CVE-2026-13414.
CVE-2026-13414 is resolved in version 4.1.18 of Cmp Coming Soon Maintenance.