CVE-2020-36707

ALTO 8.8CVE-2020-36707 · Published 07/06/2023 · updated 17/06/2026

In breve

CVE-2020-36707 è una vulnerabilità ALTO (CVSS 8.8) che riguarda nifty coming soon & maintenance mode page (wpconcern).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.45%, superiore al 39.6% delle vulnerabilità.
Correzione: aggiornare a 1.58 o successiva.

Package	Affected versions	Patched versions
nifty coming soon & maintenance mode page wpconcern	`< 1.58`	`1.58`

Description

The Coming Soon & Maintenance Mode Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.57. This is due to confusing logic functions missing or having incorrect nonce validation. This makes it possible for unauthenticated attackers to gain and perform otherwise unauthorized access and actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

References

jetpack.com/features/security/library/nifty-coming-soon-and-under-construction-page-plugin · Product
wpscan.com/vulnerability/aa47a464-af97-43bc-b6cb-75a08ce3ece7 · Third Party Advisory
acunetix.com/vulnerabilities/web/wordpress-plugin-coming-soon-maintenance-mode-page-cross-site-request-forgery-1-57 · Third Party Advisory
wordfence.com/threat-intel/vulnerabilities/id/59278214-b0ce-44bf-8d8f-265c5c50006a · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free