CVE-2022-0199: 
WordPress vulnerability analysis and mitigation

CVE-2022-0199 affects the Coming soon and Maintenance mode WordPress plugin versions before 3.6.8. The vulnerability was discovered and disclosed on January 12, 2022, with a public release on January 24, 2022 (WPScan).

The vulnerability stems from the absence of CSRF (Cross-Site Request Forgery) protection in the plugin's coming_soon_send_mail AJAX action. This security flaw allows potential attackers to execute unauthorized actions through CSRF attacks targeting authenticated administrators (WPScan).

When successfully exploited, this vulnerability enables attackers to manipulate the system to send arbitrary emails to all subscribed users through the compromised administrator's account (WPScan).

The vulnerability can be exploited through a CSRF attack that targets authenticated administrators. A proof of concept exists demonstrating how attackers can craft malicious requests to send unauthorized emails through the plugin's functionality (WPScan).

The vulnerability has been patched in version 3.6.8 of the Coming soon and Maintenance mode WordPress plugin. Users are advised to update to this version or later to protect against potential attacks (WordPress Plugin).