CVE-2024-1478 describes an improper access control vulnerability in the helderk Maintenance Mode WordPress plugin. The flaw exists in the REST API implementation, which fails to properly restrict access to protected post and page content. As a result, unauthenticated users can retrieve content that the plugin is intended to protect. This vulnerability affects all versions up to 3.0.1. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity and no privileges required. The impact is limited to confidentiality loss without integrity or availability impact. No patch or official fix has been documented in the provided data.

An attacker can access protected post and page content via the REST API without authentication, bypassing the content protection mechanisms of the plugin. This leads to sensitive information exposure but does not affect data integrity or availability. The vulnerability has a medium severity rating (CVSS 5.3). There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling the Maintenance Mode plugin or restricting REST API access through other means (e.g., firewall rules or WordPress configuration) to prevent unauthorized content access.