The Easy Maintenance Mode plugin for WordPress, developed by aankit, is designed to restrict access to site content during maintenance periods. However, versions up to and including 1.4.2 contain a vulnerability (CVE-2024-1477) classified under CWE-200 (Information Exposure). This flaw allows unauthenticated attackers to bypass the plugin's maintenance mode restrictions by querying the WordPress REST API endpoints to retrieve post and page content that should be protected. The vulnerability arises because the plugin does not properly restrict REST API access to content during maintenance mode, exposing sensitive information unintentionally. The CVSS 3.1 base score is 5.3 (medium severity), reflecting the vulnerability's network attack vector, low complexity, no privileges required, and no user interaction needed. While the impact is limited to confidentiality loss, it can reveal unpublished or sensitive content, potentially aiding further attacks or information gathering. No patches or exploits are currently documented, but the exposure risk remains until fixed.

The primary impact of this vulnerability is unauthorized disclosure of website content that should be hidden during maintenance periods. This can lead to leakage of sensitive or confidential information such as unpublished posts, internal communications, or proprietary data. For organizations relying on Easy Maintenance Mode to protect content during updates or downtime, this undermines their operational security and privacy assurances. Attackers could leverage the exposed information for social engineering, reconnaissance, or to identify further attack vectors. Although the vulnerability does not affect data integrity or site availability, the confidentiality breach can damage organizational reputation and trust, especially for sites handling sensitive or regulated information. The risk is heightened for high-profile websites, enterprises, and government portals using this plugin.

To mitigate this vulnerability, organizations should first check if they use the Easy Maintenance Mode plugin and verify the version. Since no official patch links are provided yet, immediate mitigation includes disabling the plugin during maintenance or restricting REST API access via server-level controls or WordPress filters. Implementing authentication requirements for REST API endpoints can prevent unauthorized access. Web application firewalls (WAFs) can be configured to block suspicious REST API requests targeting maintenance mode content. Monitoring REST API usage logs for unusual access patterns is also recommended. Once a vendor patch is released, promptly update the plugin to the fixed version. Additionally, consider alternative maintenance mode plugins with verified secure REST API handling if immediate patching is not feasible.