Maintenance Mode

Maintenance Mode has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2024; all 2 are fixed as of September 2026. Their average CVSS score is 5.3, and the most serious one scores 5.3 out of 10. 2024 was the busiest year with 2 disclosures.

The most common weakness is Improper Access Control, behind 1 of the records (50%). Other recurring categories include Use Of Less Trusted Source.

Every one of the 2 issues recorded for Maintenance Mode has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. Maintenance Mode is installed on roughly 7,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium
5.3/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all Maintenance Mode vulnerabilities before they are exploited.

Highest severity on recordCVSS 5.3CVE-2024-32708

Maintenance Mode by helderk <= 3.0.1 - Unauthenticated IP Spoofing

Read the full analysis

Vulnerability Records

2 records
Plugin Profile
Latestv3.2.1

Maintenance Mode

helderk

Author

helderk

4.6(14)
92/100
Last Updated
2026-08-03 (1mo ago)
Active Installs
7,000+
Downloads
139,160
Requires WP
6.2+
Requires PHP
7.4+
Tested up to
WP 7.0.4
Created
2020-11-25 (6y ago)

This plugin lets you place a WordPress site into maintenance mode and display a custom message, HTML page, or redirect users to a static page or external URL. It also disables the WordPress REST API while maintenance mode is active, helping keep site data inaccessible during maintenance. Any logged-in user with administrator privileges can be allowed to view the site, and the required capability can be changed through a filter hook. See the FAQ section for details. The maintenance mode behavior can be enabled or disabled at any time without losing the configured settings. However, deactivating the plugin is still recommended when maintenance mode is not needed. The plugin also supports excluding specific pages from maintenance mode so only selected pages remain visible. When maintenance mode is active, the plugin sends no-cache headers to help prevent caching plugins, CDNs, or browsers from storing responses that would bypass the maintenance page. When redirect mode is enabled, the plugin can send two different response codes. “200 OK” is suitable for development environments, while “503 Service Temporarily Unavailable” is better when the site is temporarily taken offline. If used for long periods, 503 may negatively affect search engine visibility. A list of IP addresses can be configured to bypass maintenance mode completely. This is useful for allowing an entire office or client team to access the site without managing individual access keys. Access keys work by creating a key on the user’s computer that is checked while maintenance mode is active. When a new key is created, a link to store the access key cookie is sent to the email address provided. Access can then be revoked by disabling or deleting the key. This plugin offers four ways to present the maintenance experience: A message rendered with WordPress’s wp_die() function, making the experience feel native to WordPress. A page styled with the active theme’s template. A custom HTML page. A redirect to a static page or external URL.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C