CVE-2024-1475 identifies an improper access control vulnerability (CWE-284) in the Coming Soon Maintenance Mode plugin for WordPress, developed by awordpresslife. This plugin is designed to restrict access to a website during maintenance or pre-launch phases by showing a 'coming soon' page. However, due to insufficient access control enforcement in the plugin's REST API endpoints, unauthenticated attackers can retrieve post and page content that should be protected. The vulnerability affects all versions up to and including 1.0.5. The REST API, which normally requires proper permissions to access content, is improperly configured, allowing sensitive information exposure without authentication or user interaction. The CVSS 3.1 base score is 5.3 (medium), reflecting the ease of exploitation (network vector, no privileges required, no user interaction) but limited impact scope (confidentiality loss only, no integrity or availability impact). No patches have been published yet, and no active exploitation has been reported. This flaw undermines the plugin’s core purpose of protecting unpublished or maintenance-phase content, potentially exposing sensitive or proprietary information to unauthorized parties.

The primary impact of this vulnerability is the unauthorized disclosure of sensitive website content, including unpublished posts and pages that may contain confidential, proprietary, or sensitive information. This can lead to information leakage that compromises business confidentiality, damages reputation, or reveals strategic plans. Although the vulnerability does not affect data integrity or availability, the exposure of sensitive content can facilitate further attacks such as social engineering or targeted phishing. Organizations relying on this plugin for content protection during maintenance or pre-launch phases are at risk of premature content exposure. The ease of exploitation without authentication increases the threat level, especially for websites with sensitive or competitive content. While no known exploits are currently active, the widespread use of WordPress and this plugin means many sites globally could be vulnerable until mitigations or patches are applied.

Until an official patch is released, organizations should implement specific mitigations to reduce risk. First, restrict REST API access by configuring WordPress to require authentication for REST endpoints or by using plugins that limit REST API exposure. Second, disable or uninstall the Coming Soon Maintenance Mode plugin if it is not essential. Third, consider replacing it with alternative maintenance mode plugins that have verified secure access controls. Fourth, implement web application firewall (WAF) rules to block unauthorized REST API requests targeting the plugin’s endpoints. Fifth, monitor web server logs for unusual REST API access patterns that may indicate exploitation attempts. Finally, maintain regular backups and prepare to update the plugin promptly once a security patch becomes available from the vendor.