CVE-2022-1576

The WP Maintenance Mode & Coming Soon plugin through version 2.4.4 contains a cross-site request forgery vulnerability affecting the reset_plugin_settings, subscribers_empty_list, dismiss_notices, subscribers_export, add_subscriber, and send_contact functions because nonce verification is not implemented on these endpoints. An attacker could exploit this flaw by crafting a malicious request that, if clicked by an administrator, would allow the attacker to clear subscriber lists, modify plugin configuration, and perform other unauthorized actions. The vulnerability was patched in version 2.4.5.

Based on public CVE data (MITRE/NVD).