CVE-2022-1580: Site Offline < 1.5.3 - Access Bypass

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-09-19 · updated 2026-06-17
Weakness: CWE-639

Description

The Site Offline Or Coming Soon Or Maintenance Mode WordPress plugin before 1.5.3 prevents users from accessing a website but does not do so if the URL contained certain keywords. Adding those keywords to the URL's query string would bypass the plugin's main feature.

Affected products

Site Offline Or Coming Soon Or Maintenance Mode: before 1.5.3 — fixed in 1.5.3

How to fix

Upgrade to a fixed version: Site Offline Or Coming Soon Or Maintenance Mode 1.5.3. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/7b6f91cd-5a00-49ca-93ff-db7220d2630a
https://wpscan.com/vulnerability/7b6f91cd-5a00-49ca-93ff-db7220d2630a

Get alerted when CVE-2022-1580 or the next vulnerability affects your stack