CVE-2024-5087
Minimal Coming Soon – Coming Soon Page <= 2.38 - Missing Authorization to Limited Settings Change
CVSS Score
6.3
EPSS Score
0.0%
EPSS Percentile
0th
The Minimal Coming Soon – Coming Soon Page plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the validate_ajax, deactivate_ajax, and save_ajax functions in all versions up to, and including, 2.38. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit the license key, which could disable features of the plugin.
| CWE | CWE-862 |
| Vendor | webfactory |
| Product | minimal coming soon – coming soon page |
| Published | Jun 8, 2024 |
| Last Updated | Apr 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for webfactory minimal coming soon – coming soon page
Be the first to know when new medium vulnerabilities affecting webfactory minimal coming soon – coming soon page are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
webfactory / Minimal Coming Soon – Coming Soon Page
0 ≤ 2.38
References
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/affdaf63-2098-4ad6-b15b-990d1941fecb?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/minimal-coming-soon-maintenance-mode/tags/2.38/framework/wf-licensing.php#L51 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/minimal-coming-soon-maintenance-mode/tags/2.38/framework/wf-licensing.php#L52 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/minimal-coming-soon-maintenance-mode/tags/2.38/framework/wf-licensing.php#L54 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/minimal-coming-soon-maintenance-mode/tags/2.38/framework/wf-licensing.php#L561 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/minimal-coming-soon-maintenance-mode/tags/2.38/framework/wf-licensing.php#L585 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/minimal-coming-soon-maintenance-mode/tags/2.38/framework/wf-licensing.php#L596 github.com: https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/CRLF%20Injection/README.md plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset/3099123/
Credits
Friderika Baranyai