The Maintenance Page plugin for WordPress contains an access control vulnerability (CWE-284) in the subscribe_download function, which is hooked via an AJAX action. This function lacks proper capability checks, enabling authenticated users with subscriber or higher roles to download subscriber email data in CSV format. The vulnerability affects all versions up to and including 1.0.8. The CVSS 3.1 base score is 5.3, indicating medium severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact.

The vulnerability allows unauthorized access to subscriber email addresses by authenticated users with subscriber or higher privileges. This can lead to privacy breaches and potential misuse of subscriber data. There is no impact on data integrity or system availability reported. No known active exploitation has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access where possible and monitor for suspicious activity related to subscriber data downloads. Avoid granting unnecessary privileges to users and consider disabling the Maintenance Page plugin if subscriber data confidentiality is critical.