The Minimal Coming Soon – Coming Soon Page plugin for WordPress suffers from a missing capability check in the validate_ajax, deactivate_ajax, and save_ajax functions in all versions up to 2.38. This CWE-862 vulnerability allows authenticated attackers with low privileges (Subscriber-level and above) to edit the license key, potentially disabling plugin features. The CVSS 3.1 score is 6.3 (medium), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

An attacker with Subscriber-level access or higher can modify the license key of the plugin without proper authorization checks. This could result in disabling certain features of the plugin, impacting availability and integrity of the plugin's functionality. Confidentiality impact is low, as the vulnerability does not directly expose sensitive data. There are no reports of active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted users only and monitor for suspicious activity related to plugin license modifications. Avoid granting Subscriber-level or higher access to untrusted users.