CVE-2019-25139

The Coming Soon Page & Maintenance Mode plugin for WordPress is vulnerable to unauthenticated settings reset in versions up to, and including 1.8.1 due to missing capability checks in the ~/functions/data-reset-post.php file which makes it possible for unauthenticated attackers to trigger a plugin settings reset.

• CWE-862
• CWE-862

• https://blog.nintechnet.com/unauthenticated-stored-xss-in-wordpress-coming-soon-page-and-maintenance-mode-plugin/Exploit
• https://plugins.trac.wordpress.org/changeset/2121321Patch
• https://plugins.trac.wordpress.org/changeset/2123149Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/61fdc6e9-75ea-4226-9527-a5fd02efde70?source=cveBroken Link, Third Party Advisory
• https://blog.nintechnet.com/unauthenticated-stored-xss-in-wordpress-coming-soon-page-and-maintenance-mode-plugin/Exploit
• https://plugins.trac.wordpress.org/changeset/2121321Patch
• https://plugins.trac.wordpress.org/changeset/2123149Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/61fdc6e9-75ea-4226-9527-a5fd02efde70?source=cveBroken Link, Third Party Advisory

Published

Jun 7, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-2511Vulnerability in the Oracle VM VirtualBox component of Oracl…
• CVE-2019-2512Vulnerability in the Primavera P6 Enterprise Project Portfol…
• CVE-2019-2513Vulnerability in the MySQL Server component of Oracle MySQL …2.5
• CVE-2019-25136A compromised child process could have injected XBL Bindings…10
• CVE-2019-25137Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remot…7.2
• CVE-2019-25138The User Submitted Posts plugin for WordPress is vulnerable …9.8
• CVE-2019-25140The WordPress Coming Soon Page & Maintenance Mode plugin for…6.1
• CVE-2019-25141The Easy WP SMTP plugin for WordPress is vulnerable to autho…9.8
• CVE-2019-25142The Mesmerize & Materialis themes for WordPress are vulnerab…8.8
• CVE-2019-25143The GDPR Cookie Compliance plugin for WordPress is vulnerabl…4.3
• CVE-2019-25144The WP HTML Mail plugin for WordPress is vulnerable to HTML …6.1
• CVE-2019-25145The Contact Form & SMTP Plugin by PirateForms plugin for Wor…6.1