CVE-2020-36707
High
Description
The Coming Soon & Maintenance Mode Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.57. This is due to confusing logic functions missing or having incorrect nonce validation. This makes it possible for unauthenticated attackers to gain and perform otherwise unauthorized access and actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
SeverityHigh
CVSS8.8
Exploit probability—
ProductWpconcern Nifty Coming Soon \& Maintenance Mode Page
PublishedJun 7, 2023
First seenJun 7, 2023
Weakness typeCWE-352Cross-site request forgery (CSRF)
How to fix
Update
- wpconcern nifty_coming_soon_\&_maintenance_mode_page1.58 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wpconcern nifty_coming_soon_\&_maintenance_mode_page | v < 1.58 | 1.58 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.