← Database

CVE-2022-0199

MEDIUM CVSS: 4.3 Published: 2022-02-21 Modified: 2026-06-17

Description

The Coming soon and Maintenance mode WordPress plugin before 3.6.8 does not have CSRF check in its coming_soon_send_mail AJAX action, allowing attackers to make logged in admin to send arbitrary emails to all subscribed users via a CSRF attack

Affected Platforms

Wpdevart Coming Soon And Maintenance Mode

Weakness Type

CWE-352

References