The Ultimate Coming Soon & Maintenance plugin for WordPress suffers from a missing authorization check (CWE-862) in the 'ucsm_update_template_name_lite' function. This allows any authenticated user with at least Subscriber privileges to change the names of the plugin's templates without proper capability verification. The vulnerability affects all versions up to 1.0.9 and has a CVSS 3.1 base score of 4.3 (medium severity), reflecting low complexity and limited impact confined to integrity of plugin template names. No patch or vendor advisory is currently available.

An attacker with Subscriber-level access or higher can modify the names of the plugin's templates, resulting in unauthorized integrity changes to plugin data. There is no impact on confidentiality or availability. The modification could potentially cause confusion or minor disruption in plugin behavior but does not allow privilege escalation or remote code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for unauthorized changes to plugin templates. Avoid granting Subscriber or higher privileges to untrusted users.