Maintenance & Coming Soon Redirect Animation

Maintenance & Coming Soon Redirect Animation has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2024; 1 is fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 4.8, and the most serious one scores 5.3 out of 10. 2024 was the busiest year with 2 disclosures.

The most common weakness is Improper Access Control, behind 1 of the records (50%). Other recurring categories include Use Of Less Trusted Source.

1 of the records (50%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2024.

2 independent researchers contributed these findings, one record each. Maintenance & Coming Soon Redirect Animation is installed on roughly 3,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.2.

Strategic Overview

Avg CVSSMedium
4.8/ 10
Patch Coverage50%
Open

1

Fixed

1

Get automatic notifications for all Maintenance & Coming Soon Redirect Animation vulnerabilities before they are exploited.

Most severe open issueCVSS 5.3CVE-2024-43944

Maintenance & Coming Soon Redirect Animation <= 2.3.0 - IP Spoofing to Bypass

Read the full analysis

Vulnerability Records

2 records
Maintenance & Coming Soon Redirect Animation banner
Latestv2.4.1

Maintenance & Coming Soon Redirect Animation

ilyasine

Author

ilyasine

5.0(33)
100/100
Last Updated
2026-09-04 (9d ago)
Active Installs
3,000+
Downloads
44,218
Requires WP
5.0+
Requires PHP
7.4+
Tested up to
WP 7.2
Created
2022-08-14 (4y ago)

This super lightweight plugin is intended primarily for developers, designers and site administrators that need to allow clients to preview the site before being available to the public or to temporarily hide it while undergoing major updates. Any logged-in user with WordPress administrator privileges will be allowed to view the site regardless of the settings in the plugin. The exact privilege can be set using a filter hook – see FAQs. The behaviour of this can be enabled or disabled at any time without losing any of the settings configured in its settings pane. However, deactivating the plugin is recommended versus having it activated while disabled. When redirect is enabled, it can send a different header types. A list of IPv4 and IPv6 addresses can be set up to completely bypass maintenance mode. IPv4 Class C wildcards are also supported. This option is useful when needing to allow a client’s entire office to access the site while in maintenance mode without needing to maintain individual access keys. Access keys work by creating a temporary cookie on the user’s computer that will be checked against when maintenance mode is active. When a new key is created, a link to create the access key cookie will be emailed to the email address provided. Access can then be revoked either by disabling or deleting the key. Whitelisted User Roles – user roles who see the site, instead of under maintenance page Whitelisted Users – users who see the site, instead of maintenance page Password Access – allow visitors to preview the site with a shared password. Password access lasts for 24 hours in each browser. Custom Maintenance Pages – select a published page from its post list actions to use it as the maintenance page, with an option to exclude individual public posts from maintenance mode. Custom Login URL – optionally restrict direct access to wp-login.php and use a custom login URL instead. Animations : Animation on the web is not only fun, but engaging in such a way that it has converted site visitors into customers even before will be available to the general public and it will make them eagerly await its launch. You can either choose your animation from the library or upload your own; this animation will be shown in front of your site when it is undergoing maintenance. The included Lottie Animation (WP Loti) Gutenberg block lets you insert an animation from the plugin library into posts and pages, with autoplay, loop, width, and height controls. Notes : ✔ This plugin will override any other maintenance plugin you use. ✔ All settings are auto-updated , you don’t need to save anything . WP-CLI Commands : Note : before you begin run these commands make sure you have wp-cli installed on your server and your are in your WordPress site Root folder ✔ To install the plugin via wp-cli : sudo wp plugin install maintenance-coming-soon-redirect-animation --allow-root ✔ To activate it : sudo wp plugin activate maintenance-coming-soon-redirect-animation --allow-root ✔ To deactivate it : sudo wp plugin deactivate maintenance-coming-soon-redirect-animation --allow-root ✔ To uninstall it : sudo wp plugin uninstall maintenance-coming-soon-redirect-animation --allow-root Note : before you can uninstall the plugin you have to deactivate it first ✔ To Update the plugin : sudo wp plugin update maintenance-coming-soon-redirect-animation --allow-root

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C