CVE-2022-0199

PoC —

CVSS 3.1

4.3 medium

EPSS

<1%p40

Published

Feb 21, 2022 (Feb 21, 2022)

Modified

Jun 17, 2026

Description

The Coming soon and Maintenance mode WordPress plugin before 3.6.8 does not have CSRF check in its coming_soon_send_mail AJAX action, allowing attackers to make logged in admin to send arbitrary emails to all subscribed users via a CSRF attack

Vendors: wpdevart
Products: coming soon and maintenance mode
Ecosystems: WordPress
Weakness: CWE-352
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news0 stories

No ingested article mentions this CVE yet.