CVE-2026-34896
Published: 07 April 2026
Summary
CVE-2026-34896 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 6.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-34896 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, affecting the WordPress plugin "Under Construction, Coming Soon & Maintenance Mode" developed by Analytify. The flaw impacts all versions from n/a through 2.1.1, with a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). It enables forged requests to execute unauthorized actions on behalf of authenticated users interacting with the plugin's administrative functions.
Attackers with network access can exploit this vulnerability by tricking authenticated WordPress administrators or users into visiting a malicious webpage that submits forged requests to the vulnerable plugin endpoints. Exploitation requires user interaction, such as clicking a link, and involves high attack complexity due to CSRF protections or token requirements. Successful exploitation grants high-impact confidentiality, integrity, and availability effects, potentially allowing attackers to alter plugin settings, enable/disable maintenance modes, or perform other privileged actions without the victim's knowledge.
The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/under-construction-maintenance-mode/vulnerability/wordpress-under-construction-coming-soon-maintenance-mode-plugin-2-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve provides details on the vulnerability, including recommended mitigations such as updating to a patched version beyond 2.1.1 or implementing CSRF tokens in custom integrations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-19590
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in Analytify Under Construction, Coming Soon & Maintenance Mode allows Cross Site Request Forgery.This issue affects Under Construction, Coming Soon & Maintenance Mode: from n/a through 2.1.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF vulnerability in public-facing WordPress plugin admin functions enables forged requests from authenticated users, directly facilitating exploitation of the public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 enforces session authenticity mechanisms like CSRF tokens, directly preventing forged requests from executing unauthorized actions on behalf of authenticated WordPress administrators.
SI-10 requires validation of information inputs, including CSRF tokens, to block malicious forged requests targeting the plugin's administrative endpoints.
SI-2 mandates timely flaw remediation, such as patching the vulnerable plugin versions up to 2.1.1, eliminating the specific CSRF vulnerability.