¿Es seguro Cmp Coming Soon Maintenance?

Qué hace este plugin

• Slug: cmp-coming-soon-maintenance
• 200000+ instalaciones activas

coming sooncoming soon pagelaunch pagemaintenance modeunder construction

Estado de mantenimiento

• Última versión conocida: 4.1.17
• Requiere PHP: 5.6+
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

7 CVEs conocidos registrados para Cmp Coming Soon Maintenance. Reportadas entre 2020 y 2026.

CVE-2026-6518

The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to arbitrary file upload and remote code execution in all versions up to, and including, 4.1.16 via the `cmp_theme_update_install` AJAX action. This is due to the function only checking for the `publish_pages` capability (available to Editors and above) instead of `manage_options` (Administrators only), combined with a lack of proper validation on the user-supplied file URL and no verification of the downloaded file's content before extraction. This makes it possible for authenticated attackers, with Administrator-level access and above, to force the server to download and extract a malicious ZIP file from a remote attacker-controlled URL into a web-accessible directory (`wp-content/plugins/cmp-premium-themes/`), resulting in remote code execution. Due to the lack of a nonce for Editors, they are unable to exploit this vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2025-32118

The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 4.1.13. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2023-50374

Update the WordPress CMP – Coming Soon & Maintenance plugin to the latest available version (at least 4.1.11). Yuchen Ji discovered and reported this Server Side Request Forgery (SSRF) vulnerability in WordPress CMP – Coming Soon & Maintenance Plugin. This could allow a malicious actor to cause a website to execute website requests to an arbitrary domain of the attacker. This could allow a malicious actor to find sensitive information of other services running on the system. This vulnerability has been fixed in version 4.1.11. This vulnerability was reported to and published by Patchstack. Our users receive alerts and protections up to 48 hours in advance. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2020-36730

The CMP for WordPress is vulnerable to authorization bypass due to a missing capability check on the cmp_get_post_detail(), niteo_export_csv(), and cmp_disable_comingsoon_ajax() functions in versions up to, and including, 3.8.1. This makes it possible for unauthenticated attackers to read posts, export subscriber lists, and/or deactivate the plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2023-2159

Update the WordPress CMP – Coming Soon & Maintenance plugin to the latest available version (at least 4.1.8). Marco Wotschka discovered and reported this Bypass Vulnerability vulnerability in WordPress CMP – Coming Soon & Maintenance Plugin. A bypass vulnerability could allow a malicious actor to bypass certain restrictions in the code. This vulnerability has been fixed in version 4.1.8.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-1263

The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 4.1.6 via the cmp_get_post_detail function. This can allow unauthenticated individuals to obtain the contents of any non-password-protected, published post or page even when maintenance mode is enabled.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2022-0188

Unauthenticated Arbitrary CSS Update vulnerability discovered by Krzysztof Zając in WordPress CMP – Coming Soon & Maintenance plugin (versions <= 4.0.18).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CMP – Coming Soon & Maintenance Plugin by NiteoThemes [cmp-coming-soon-maintenance] < 4.0.10

Remote Code Execution (RCE) vulnerability discovered by Ngo Van Thien (Sun* Cyber Security Research Team) Patchstack Red Team member in WordPress CMP – Coming Soon & Maintenance plugin (versions <= 4.0.9).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

+ 6 vulnerabilidades conocidas más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
—	CMP – Coming Soon & Maintenance Plugin by NiteoThemes [cmp-coming-soon-maintenance] < 4.0.10	—	Desconocido	< 4.0.10	4.0.10	2021-05-02	✓ corregido en la última versión
—	CMP – Coming Soon & Maintenance Plugin by NiteoThemes [cmp-coming-soon-maintenance] < 3.8.2	—	Desconocido	< 3.8.2	3.8.2	2020-08-04	✓ corregido en la última versión
—	CMP – Coming Soon & Maintenance Plugin by NiteoThemes [cmp-coming-soon-maintenance] < 3.8.2	—	Desconocido	< 3.8.2	3.8.2	2020-08-04	✓ corregido en la última versión
—	CMP – Coming Soon & Maintenance Plugin by NiteoThemes [cmp-coming-soon-maintenance] < 3.8.2	—	Desconocido	< 3.8.2	3.8.2	2020-08-04	✓ corregido en la última versión
—	CMP – Coming Soon & Maintenance Plugin by NiteoThemes [cmp-coming-soon-maintenance] < 3.8.2	—	Desconocido	< 3.8.2	3.8.2	2020-08-04	✓ corregido en la última versión
—	CMP – Coming Soon & Maintenance Plugin by NiteoThemes [cmp-coming-soon-maintenance] < 3.8.2	—	Desconocido	< 3.8.2	3.8.2	—	✓ corregido en la última versión

CMP – Coming Soon & Maintenance Plugin by NiteoThemes [cmp-coming-soon-maintenance] < 4.0.10

Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered by Ngo Van Thien (Sun* Cyber Security Research Team) Patchstack Red Team member in WordPress CMP – Coming Soon & Maintenance plugin (versions <= 4.0.9).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CMP – Coming Soon & Maintenance Plugin by NiteoThemes [cmp-coming-soon-maintenance] < 3.8.2

Arbitrary Post Read (draft, pending, private, or even password-protected) vulnerability discovered by NinTechNet in WordPress CMP – Coming Soon & Maintenance plugin (versions <= 3.8.1).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CMP – Coming Soon & Maintenance Plugin by NiteoThemes [cmp-coming-soon-maintenance] < 3.8.2

Unauthenticated Subscribers List Export vulnerability discovered by NinTechNet in WordPress CMP – Coming Soon & Maintenance plugin (versions <= 3.8.1).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CMP – Coming Soon & Maintenance Plugin by NiteoThemes [cmp-coming-soon-maintenance] < 3.8.2

Unauthenticated Plugin Deactivation vulnerability discovered by NinTechNet in WordPress CMP – Coming Soon & Maintenance plugin (versions <= 3.8.1).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CMP – Coming Soon & Maintenance Plugin by NiteoThemes [cmp-coming-soon-maintenance] < 3.8.2

The CMP for WordPress is vulnerable to authorization bypass due to a missing capability check on the cmp_get_post_detail(), niteo_export_csv(), and cmp_disable_comingsoon_ajax() functions in versions up to, and including, 3.8.1. This makes it possible for unauthenticated attackers to read posts, export subscriber lists, and/or deactivate the plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CMP – Coming Soon & Maintenance Plugin by NiteoThemes [cmp-coming-soon-maintenance] < 3.8.2

Some of the AJAX calls from the plugin do not properly check for capabilities and CSRF tokens, leading to issues such as arbitrary post read, subscribers list export and plugin deactivation.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Cómo solucionarlo

Mantén Cmp Coming Soon Maintenance actualizado — 4.1.17 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• Maintenance — 1000000+ instalaciones activas — 88/100 (857) — PHP máx. 8.4
• Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode — 700000+ instalaciones activas — 98/100 (4699) — PHP máx. <8.0
• Under Construction — 600000+ instalaciones activas — 96/100 (1284) — PHP máx. 8.4
• LightStart – Maintenance Mode, Coming Soon and Landing Page Builder — 400000+ instalaciones activas — 86/100 (870) — PHP máx. 8.4
• Minimal Coming Soon – Coming Soon Page — 100000+ instalaciones activas — 88/100 (280)