CVE-2024-1075 describes an authorization bypass vulnerability in the webfactory Minimal Coming Soon – Coming Soon Page WordPress plugin, affecting all versions up to and including 2.37. The issue arises from improper validation of the request path, which allows unauthenticated attackers to bypass the plugin's maintenance mode protections and view pages intended to be hidden. This vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS 3.1 base score is 3.7 (low), reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and limited confidentiality impact.

An attacker can bypass the maintenance mode feature of the plugin and access content that should be restricted during maintenance periods. The impact is limited to information disclosure of pages that are meant to be hidden, with no reported integrity or availability impact. The vulnerability does not require authentication and can be exploited remotely, but the attack complexity is high, and the confidentiality impact is low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the webfactory vendor advisories for updates. Until a fix is available, consider disabling the plugin or restricting access to the site during maintenance periods using alternative methods.