What is GHSA-6c47-jwpm-32qx?

GHSA-6c47-jwpm-32qx is a security advisory published by GitHub Security Advisories with Medium severity. The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX...

Which CVE IDs does GHSA-6c47-jwpm-32qx cover?

GHSA-6c47-jwpm-32qx covers the following CVE IDs: CVE-2026-13414. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6c47-jwpm-32qx?

GHSA-6c47-jwpm-32qx has a CVSS v3 base score of 4.8, published by GitHub Security Advisories.

GHSA-6c47-jwpm-32qxMediumCVSS 4.8

The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX...

Vendor

GitHub Security Advisories

Published

August 27, 2026

Last Modified

August 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-13414 →

📋 Description

The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain (and exposed to anonymous visitors on others), allowing unauthenticated attackers to disable the site's maintenance/coming-soon mode under a non-default countdown configuration.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-13414
https://wpscan.com/vulnerability/096f11ce-060a-403a-8af0-ae2ee7676318
https://github.com/advisories/GHSA-6c47-jwpm-32qx