CVE-2023-2159 CMP – Coming Soon & Maintenance <= 4.1.7 - Maintenance Mode Bypass

Q: What is CVE-2023-2159?

CVE-2023-2159 is a medium-severity vulnerability in CMP – Coming Soon & Maintenance Plugin by NiteoThemes, published on 9 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Q: Is CVE-2023-2159 being exploited?

There is no known exploitation of CVE-2023-2159 in the wild and no public exploit code.

Q: How do I fix CVE-2023-2159?

No fix has been published for CVE-2023-2159 yet. Limit exposure of the affected software until one is available.

Medium 5.3 Published 9 Jun 2023 Updated 8 Apr 2026

Attackers can bypass maintenance mode restrictions by guessing the MD5 hash of the site URL, allowing unauthorized access to the site.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-2159?

CVE-2023-2159 is a medium-severity vulnerability in CMP – Coming Soon & Maintenance Plugin by NiteoThemes, published on 9 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Maintenance Mode Bypass in versions up to, and including, 4.1.7. A correct cmp_bypass GET parameter in the URL (equal to the md5-hashed home_url in the default setting) allows users to visit a site placed in maintenance mode thus bypassing the plugin's provided feature.

Weakness: CWE-284

Which versions are affected by CVE-2023-2159?

It affects 1 product.

Products include Niteothemes Cmp.

How do I fix CVE-2023-2159?

No fix has been published for CVE-2023-2159 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-2159 being exploited?

There is no known exploitation of CVE-2023-2159 in the wild and no public exploit code.

Sources

Also known as GHSA-vw9j-prfj-jvhh.