CVE-2026-13414: CWE-862 Missing Authorization in CMP

CVE-2026-13414 is a missing authorization vulnerability (CWE-862) in the CMP WordPress plugin prior to version 4.1.18. The plugin does not perform proper authorization checks on a specific AJAX action and relies on a nonce that is bypassed under certain conditions. This allows unauthenticated attackers to disable the site's maintenance or coming-soon mode if a non-default countdown configuration is active. The CVSS 3.1 base score is 4.8 (medium severity) with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity with low severity.

An unauthenticated attacker can disable the maintenance or coming-soon mode of a WordPress site using the CMP plugin before 4.1.18 under specific countdown configurations. This could lead to premature exposure of the site content or functionality that was intended to be hidden during maintenance, potentially leaking information or disrupting intended site behavior. The impact on confidentiality and integrity is rated low, and availability is not affected.

No official patch or remediation level is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, site administrators should consider disabling the affected AJAX action or restricting access to it via other means, and avoid using non-default countdown configurations that expose the nonce bypass. Monitor vendor channels for updates and apply official patches once released.