CVE-2026-34896

CVE-2026-34896 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Analytify Under Construction, Coming Soon & Maintenance Mode WordPress plugin through version 2.1.1. This vulnerability allows attackers to perform unauthorized actions on behalf of authenticated users by tricking them into visiting malicious web pages. The flaw could enable attackers to modify plugin settings or perform other administrative functions without explicit user consent. The vulnerability carries a HIGH severity rating with a CVSS score of 7.5, requiring network access and user interaction but potentially resulting in high impact across confidentiality, integrity, and availability. While the attack complexity is rated as high, successful exploitation could allow attackers to compromise sensitive administrative functions of the affected WordPress installation. Currently, this vulnerability is not being actively exploited in the wild, with no public exploit code confirmed available and minimal community attention. The EPSS score of 0.00019 indicates this represents a lower-probability exploitation risk compared to other known vulnerabilities, and the vulnerability does not appear on the Known Exploited Vulnerabilities (KEV) catalog. Organizations should prioritize updating the plugin to a patched version but may deprioritize this relative to more actively exploited threats.