CVE-2023-46615 is a medium severity (CVSS 5.4) deserialization of untrusted data flaw in the KD Coming Soon WordPress plugin, versions through 1.7. Patchstack lists no official patch. Remove or replace the plugin if you can, and keep the site behind a firewall rule until a fix ships.
What's affected
The record says KD Coming Soon is affected from n/a through 1.7. Patchstack says the same and shows no patched version. It states that no official patch is available and that it has issued a mitigation rule to block attacks. Patchstack also rates the issue High priority and warns it is likely to be used in mass campaigns, which is stronger than the NVD medium score. We report both.
Patchstack says no login is required. The weakness is CWE-502, listed as PHP object injection.
The NVD record scores it 5.4 (Medium) with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N. The weakness class is CWE-502 (deserialization of untrusted data). The record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
From the command line:
wp plugin list --fields=name,version,status
Or open Plugins in the WordPress admin and look for KD Coming Soon. Any version at 1.7 or below is in range, even if the plugin is deactivated but still present on disk, so check the plugins folder too.
What to do now
- Deactivate and delete the KD Coming Soon plugin if you do not need it.
- Use a different maintained coming soon plugin or a simple static page.
- If you must keep it, enable a virtual patch or web application firewall rule that blocks the pattern, such as the one Patchstack mentions.
- Check the site for unexpected files, users and scheduled tasks.
- Monitor the plugin page for a new release.
Why it matters
PHP object injection happens when the application turns attacker controlled text back into PHP objects. Whether that is harmful depends on which classes are loaded on the site, so impact varies from nothing to full code execution when another plugin offers a useful chain.
That uncertainty is why the NVD score is moderate and Patchstack warns about mass use. With no official patch, the safest step is removal. A coming soon page is easy to replace.
Quick check
Is there a fix?
Patchstack lists no official patch. Remove the plugin or use a virtual patch.
Do I need to be logged in to be hit?
Patchstack says no login is required.
Sources
Last reviewed: 19 October 2026.
