CVE-2022-1580 describes an authorization bypass vulnerability in the Site Offline Or Coming Soon Or Maintenance Mode WordPress plugin prior to version 1.5.3. This flaw allows unauthenticated users to bypass the plugin's offline mode by including specific keywords in the URL's query string, thereby gaining unauthorized access to the website. The vulnerability has a CVSS score of 4.3 (Medium), indicating a low attack complexity and requiring no user interaction, but it does necessitate low privileges for exploitation. The potential impact is limited to confidentiality, as an attacker could view the website content while it is intended to be offline. Currently, there is no evidence of active exploitation (KEV: No, Hot List: Inactive). While no Metasploit or ExploitDB modules exist, a Nuclei template is available for detecting this vulnerability. Community discussion and media coverage are minimal, suggesting low public awareness.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.5.3CPE matchmatch criteria | cpe:2.3:a:freehtmldesigns:site_offline:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.