CVE-2023-7019
The LightStart – Maintenance Mode, Coming Soon and Landing Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the insert_template function in all versions up to, and including, 2.6.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to change page designs.
- Score
- CVSS 3.1 4.3 Medium
- Status
- Modified - security@wordfence.com
- Published
- 2024-01-11
- Last modified
- 2026-04-08
- Weaknesses
- CWE-862
Affected products
- Coming Soon And Landing Page Builder (Themeisle)
- Lightstart (Themeisle)
- Lightstart Maintenance Mode (Themeisle)
References
- https://plugins.trac.wordpress.org/changeset/3013229/wp-maintenance-mode/trunk/includes/classes/wp-maintenance-mode-adm…
- https://www.wordfence.com/threat-intel/vulnerabilities/id/b57d3d1d-dcdb-4f11-82d8-183778baa075?source=cve
