WP Maintenance Vulnerability – Information Exposure – CVE-2024-1472 | WordPress Plugin Vulnerability Report

Plugin Name: WP Maintenance

Key Information:

  • Software Type: Plugin
  • Software Slug: wp-maintenance
  • Software Status: Active
  • Software Author: florent73
  • Software Downloads: 903,892
  • Active Installs: 50,000
  • Last Updated: February 27, 2024
  • Patched Versions: 6.1.7
  • Affected Versions: <= 6.1.6

Vulnerability Details:

  • Name: WP Maintenance <= 6.1.6
  • Title: Information Exposure
  • Type: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
  • CVE: CVE-2024-1472
  • CVSS Score: 5.3
  • Publicly Published: February 16, 2024
  • Researcher: Francesco Carlucci
  • Description: The WP Maintenance plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.1.6 via the REST API. This vulnerability allows unauthenticated attackers to bypass the plugin's maintenance mode and obtain post and page content via REST API.


The WP Maintenance plugin for WordPress has a vulnerability in versions up to and including 6.1.6 that allows unauthenticated attackers to expose sensitive information via the REST API. This vulnerability has been patched in version 6.1.7.

Detailed Overview:

Discovered by researcher Francesco Carlucci, the vulnerability in WP Maintenance plugin versions 6.1.6 and below exposes a significant risk. The flaw lies within the plugin's REST API, where it fails to properly restrict access to website content when in maintenance mode. As a result, attackers can bypass the maintenance page and access content that should be restricted, leading to potential information exposure. Given the nature of this vulnerability, it's crucial for website administrators to update to the patched version to protect against unauthorized data access.

Advice for Users:

  • Immediate Action: Update your WP Maintenance plugin to version 6.1.7 immediately to mitigate the vulnerability.
  • Check for Signs of Vulnerability: Monitor your website's access logs for any unusual or unauthorized attempts to access content via the REST API. Look out for unexpected IP addresses or request patterns that could indicate exploitation attempts.
  • Alternate Plugins: While the latest version of WP Maintenance is secure, users might consider exploring other maintenance mode plugins as a precautionary measure, especially those with a strong security track record.
  • Stay Updated: Regularly check for updates to all your WordPress plugins and themes, ensuring you apply them promptly to protect against known vulnerabilities.


The swift action by WP Maintenance's developers to release a patched version highlights the critical nature of maintaining up-to-date plugins on your WordPress site. With the potential for sensitive information to be exposed, it's imperative for users to upgrade to version 6.1.7 or later, securing their sites against this vulnerability.


In today's interconnected world, the security of your WordPress website is paramount, acting as a bulwark to protect your digital presence and the sensitive information it harbors. The recent identification of a security vulnerability in the WP Maintenance plugin, cataloged as CVE-2024-1472, serves as a stark reminder of the vulnerabilities that can compromise this security. With the plugin installed on over 50,000 websites, the potential for widespread information exposure cannot be ignored, emphasizing the critical need for constant vigilance and prompt action in maintaining plugin updates.

Plugin Overview:

WP Maintenance, a widely utilized plugin developed by florent73, enables WordPress site administrators to activate a maintenance mode, effectively restricting public access during updates or changes. Despite its utility, a critical flaw was discovered in versions up to and including 6.1.6, making it susceptible to information exposure vulnerabilities.

Vulnerability Details:

CVE-2024-1472 exposes a significant risk where unauthenticated attackers can bypass the maintenance mode to access and expose post and page content via the REST API. This flaw, arising from insufficient input sanitization and output escaping, was made public on February 16, 2024, by researcher Francesco Carlucci, marking a CVSS score of 5.3 that indicates a medium severity level.

Risks and Potential Impacts:

The implications of this vulnerability are far-reaching, potentially allowing attackers to gain unauthorized access to sensitive content, thereby compromising the integrity and privacy of a website. Such breaches can erode user trust, tarnish reputations, and even lead to significant legal and financial repercussions for small business owners.

Remediation Strategies:

To mitigate this risk, it is imperative for users of the WP Maintenance plugin to update to the patched version 6.1.7 immediately. Additionally, website administrators should conduct thorough reviews of their website's access logs for any unusual or unauthorized attempts to exploit this vulnerability.

Historical Context:

This is not the first vulnerability found in the WP Maintenance plugin, with three previous issues reported since November 19, 2019. This history underscores the importance of regular security audits and updates to preempt potential exploits.


The rapid development and release of a patched version (6.1.7) by WP Maintenance's developers underscore the importance of timely updates in the ecosystem of WordPress plugins. For small business owners, the task of constantly monitoring and updating plugins can seem daunting. However, the security of your website and the protection of your users' data hinge on these critical updates. Employing managed WordPress hosting services, utilizing automatic update features, and staying informed about the latest security threats can significantly alleviate the burden, ensuring your website remains secure and resilient against the evolving landscape of digital vulnerabilities.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

WP Maintenance Vulnerability – Information Exposure – CVE-2024-1472 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment