CVE-2024-1181 Coming Soon, Under Construction & Maintenance Mode By Dazzler <= 2.1.2 - Maintenance Mode Bypass
Unauthenticated attackers can bypass maintenance mode restrictions to access confidential site content due to improper admin area detection.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-1181?
CVE-2024-1181 is a medium-severity vulnerability in dazzlersoft Coming Soon, Under Construction & Maintenance Mode By Dazzler, published on 20 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Coming Soon, Under Construction & Maintenance Mode By Dazzler plugin for WordPress is vulnerable to maintenance mode bypass in all versions up to, and including, 2.1.2. This is due to the plugin relying on the REQUEST_URI to determine if the page being accesses is an admin area. This makes it possible for unauthenticated attackers to bypass maintenance mode and access the site which may be considered confidential when in maintenance mode.
Weakness: CWE-862
Which versions are affected by CVE-2024-1181?
How do I fix CVE-2024-1181?
No fix has been published for CVE-2024-1181 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-1181 being exploited?
There is no known exploitation of CVE-2024-1181 in the wild and no public exploit code.
Sources
Also known as GHSA-rf45-g4gv-fh4v.