CVE-2024-2017 | BDVDB-2026-238484 Detail
adamskaatCountdown, Coming Soon, Maintenance – Countdown & Clock
Description#
The Countdown, Coming Soon, Maintenance – Countdown & Clock plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the conditionsRow and switchCountdown functions in all versions up to, and including, 2.7.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject PHP Objects and modify the status of countdowns.
Impact#
Per CVSS v3.1: confidentiality impact low, integrity impact low, availability impact none. Attack vector: network.
Weaknesses#
- CWE-862 Missing Authorization
References#
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d8fab229-cd6b-45a3-9e80-a03a1704ad3e?source=cve
- https://plugins.trac.wordpress.org/browser/countdown-builder/trunk/classes/Ajax.php#L92
- https://plugins.trac.wordpress.org/browser/countdown-builder/trunk/classes/Ajax.php#L51
- https://plugins.trac.wordpress.org/changeset/3097588/
- https://plugins.trac.wordpress.org/changeset/3096150/
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.