WP Maintenance Mode & Coming Soon <= 2.4.4 - Cross-Site Request Forgery

The WP Maintenance Mode & Coming Soon plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.4. This is due to missing nonce validation on the reset_plugin_settings, subscribers_empty_list, dismiss_notices, subscribers_export, add_subscriber, & send_contact functions. This makes it possible for unauthenticated attackers to perform a variety of actions such as emptying the subscribers list and resetting the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.