Under Construction, Coming Soon & Maintenance Mode Server-Side Request Forgery (SSRF) Scanner

The Under Construction, Coming Soon & Maintenance Mode plugin is a widely deployed WordPress tool, used mainly by website administrators and developers. The plugin allows users to easily set their site into maintenance mode, displaying a friendly notice when visitors try to access the site. It is often employed during site updates, redesigns, or initial construction phases to keep aspects of the development work private. Popular among both small business owners and larger enterprises, this plugin ensures that a professional appearance is maintained even when full site access is temporarily rescinded. The tool's simplicity and effectiveness make it a staple for those who want to ensure their site is always properly presented to the public. Regular updates and active support further enhance its reliability and appeal among WordPress users.

Server Side Request Forgery (SSRF) is a type of web security vulnerability that allows an attacker to induce the server-side application to make HTTP requests to an arbitrary domain of the attacker's choosing. SSRF vulnerabilities can often enable a malicious actor to bypass firewalls, access internal-only services, and sometimes exploit sensitive data. In the context of this plugin, the vulnerability arises when user-supplied input is used to construct URLs for fetching external resources, such as images or scripts, without proper validation or sanitization.

Specifically, the vulnerability exists in the plugin's handling of the 'comingsoon_redirect_url' parameter or similar endpoints that accept URLs for redirection or resource loading. An attacker can craft a request that includes a malicious URL pointing to an internal IP address (e.g., 127.0.0.1) or a cloud metadata endpoint (e.g., 169.254.169.254). The plugin then processes this URL, making an HTTP request from the server to the attacker-specified destination, thereby enabling SSRF.

If exploited, an attacker could scan internal networks, access cloud instance metadata (such as AWS credentials), or interact with other internal services that are not intended to be exposed. This could lead to data breaches, privilege escalation, or further compromise of the server infrastructure. The CVSS score of 7.0 reflects the high potential impact and the relative ease of exploitation, especially if the plugin is used in environments with sensitive internal resources.