The CGC Maintenance Mode plugin for WordPress, versions up to and including 1.2, contains an improper access control vulnerability (CWE-284) that allows unauthenticated users to view protected posts through the REST API despite maintenance mode being enabled. This exposure occurs because the plugin does not adequately restrict access to content intended to be hidden during maintenance. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with no privileges or user interaction required, and limited confidentiality impact. No patch or official remediation guidance is currently available.

An attacker without authentication can access protected posts that should be hidden during maintenance mode, leading to sensitive information exposure. The impact is limited to confidentiality with no integrity or availability effects. This could disclose content intended to be restricted temporarily, potentially leaking sensitive or private information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling the CGC Maintenance Mode plugin or restricting REST API access through other means such as firewall rules or additional authentication layers to prevent unauthorized access to protected content.