4.3med
CVE-2018-20155
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated subscriber users to bypass intended access restrictio…
Published 7 y ago · modified 4 mo ago · JSON
CVSS
4.3
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.8%
percentile 56%
Public exploits
0
none known
Summary
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated subscriber users to bypass intended access restrictions on changes to plugin settings.
Exploit prediction (EPSS)
0.78% probability of exploitation in the next 30 days, higher than 56% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 4.3 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:N/I:P/A:N |
Classification
- Weakness
- CWE-862 Missing Authorization
References
- wordfence.com /blog/2016/07/3-vulnerabilities-wp-maintenance-mode/ · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2018-20155
- NVD: CVE-2018-20155
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.