CVE-2024-9706

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-9706
The Ultimate Coming Soon & Maintenance plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ucsm_activate_lite_template_lite function in all versions up to, and including, 1.0.9. This makes it possible for unauthenticated attackers to change the template used for the coming soon / maintenance page.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://plugins.trac.wordpress.org/browser/ultimate-coming-soon/trunk/backend/tabs-content/templates/frontend-part/display-template.php#L105 Product
https://www.wordfence.com/threat-intel/vulnerabilities/id/a535eb7f-5ec7-4b3b-b46f-4f09434d04b6?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:rstheme:ultimate_coming_soon_\&_maintenance:*:*:*:*:*:*:*:*
History

05 Jun 2025, 15:57

Type Values Removed Values Added
CPE cpe:2.3:a:rstheme:ultimate_coming_soon_\&_maintenance:*:*:*:*:*:*:*:*
First Time Rstheme
Rstheme ultimate Coming Soon \& Maintenance
References () https://plugins.trac.wordpress.org/browser/ultimate-coming-soon/trunk/backend/tabs-content/templates/frontend-part/display-template.php#L105 - () https://plugins.trac.wordpress.org/browser/ultimate-coming-soon/trunk/backend/tabs-content/templates/frontend-part/display-template.php#L105 - Product
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/a535eb7f-5ec7-4b3b-b46f-4f09434d04b6?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/a535eb7f-5ec7-4b3b-b46f-4f09434d04b6?source=cve - Third Party Advisory
Summary
  • (es) El complemento Ultimate Coming Soon & Maintenance para WordPress es vulnerable a la modificación no autorizada de datos debido a una verificación de capacidad faltante en la función ucsm_activate_lite_template_lite en todas las versiones hasta la 1.0.9 incluida. Esto hace posible que atacantes no autenticados cambien la plantilla utilizada para la página de próximamente o mantenimiento.

06 Dec 2024, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-06 09:15

Updated : 2025-06-05 15:57

NVD link : CVE-2024-9706

Mitre link : CVE-2024-9706

CVE.ORG link : CVE-2024-9706

JSON object : View

Products Affected

rstheme

  • ultimate_coming_soon_\&_maintenance
CWE
CWE-862

Missing Authorization