CVE-2020-6167

A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows a CSRF attack to enable maintenance mode, inject XSS, modify several important settings, or include remote files as a logo.

• CWE-352

• https://wordpress.org/plugins/minimal-coming-soon-maintenance-mode/#developersRelease Notes, Vendor Advisory
• https://wpvulndb.com/vulnerabilities/10007Third Party Advisory
• https://www.wordfence.com/blog/2020/01/multiple-vulnerabilities-patched-in-minimal-coming-soon-maintenance-mode-coming-soon-page-plugin/Exploit, Third Party Advisory
• https://wordpress.org/plugins/minimal-coming-soon-maintenance-mode/#developersRelease Notes, Vendor Advisory
• https://wpvulndb.com/vulnerabilities/10007Third Party Advisory
• https://www.wordfence.com/blog/2020/01/multiple-vulnerabilities-patched-in-minimal-coming-soon-maintenance-mode-coming-soon-page-plugin/Exploit, Third Party Advisory

Published

Jan 9, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-6159URLs using “javascript:” have the protocol removed when past…6.1
• CVE-2020-6162An issue was discovered in Bftpd 5.3. Under certain circumst…9.1
• CVE-2020-6163The WikibaseMediaInfo extension 1.35 for MediaWiki allows XS…6.1
• CVE-2020-6164In SilverStripe through 4.5.0, a specific URL path configure…7.5
• CVE-2020-6165SilverStripe 4.5.0 allows attackers to read certain records …5.3
• CVE-2020-6166A flaw in the WordPress plugin, Minimal Coming Soon & Mainte…5.4
• CVE-2020-6168A flaw in the WordPress plugin, Minimal Coming Soon & Mainte…7.6
• CVE-2020-6170An authentication bypass vulnerability on Genexis Platinum-4…9.8
• CVE-2020-6171A cross-site scripting (XSS) vulnerability in the index page…6.1
• CVE-2020-6173TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows U…5.3
• CVE-2020-6174TUF (aka The Update Framework) through 0.12.1 has Improper V…9.8
• CVE-2020-6175Citrix SD-WAN 10.2.x before 10.2.6 and 11.0.x before 11.0.3 …5.9