Quick answers
- Is CVE-2026-13414 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-13414 being exploited in the wild.
- How severe is CVE-2026-13414?
- Medium severity, with a CVSS score of 4.8, published 27 August 2026.
- Which products and versions are affected?
- Automatic CMP - Coming Soon & Maintenance before 4.1.18.
- Is there a fix for CVE-2026-13414?
- A patch was published on 2026-08-25: Fixed in version 4.1.18 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-13414 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-13414?
- Check whether you run Automatic CMP - Coming Soon & Maintenance at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the plugin's cmp_disable_comingsoon_ajax AJAX action. The plugin relies on WordPress nonces for CSRF protection, but when certain builder themes (Divi, Elementor, Oxygen Builder) are selected with countdown mode enabled, the nonce validation is skipped entirely. An unauthenticated attacker can send a POST request to wp-admin/admin-ajax.php with action=cmp_disable_comingsoon_ajax&status=disable-cmp to flip the niteoCS_status option from "on" to "0", immediately disabling the maintenance/coming-soon page. No authentication, cookies, or valid nonce are required. The issue is scoped to three specific builder themes; other CMP themes enforce the nonce check and are not vulnerable. The plugin maintainers patched this in version 4.1.18.
Affected products
- Automatic CMP - Coming Soon & Maintenance before 4.1.18
Timeline
- 2026-08-25: disclosed
- 2026-08-27: advisory
- 2026-08-25: patched: Fixed in version 4.1.18