PT-2024-18629 · WordPress · Countdown

Lucio Sá · Published 2024-06-05 · Updated 2024-09-25 · CVE-2024-2017

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Countdown, Coming Soon, Maintenance – Countdown & Clock plugin for WordPress versions up to, and including, 2.7.8

Description The issue is related to a missing capability check on the conditionsRow and switchCountdown functions, allowing authenticated attackers with subscriber-level access and above to inject PHP Objects and modify the status of countdowns.

Recommendations For versions up to, and including, 2.7.8, consider disabling the conditionsRow and switchCountdown functions until a patch is available to prevent unauthorized access and PHP Object injection. Restrict access to the plugin's functionality to minimize the risk of exploitation, especially for users with subscriber-level access and above.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-2017

Affected Products

Countdown

References · 12

• https://plugins.trac.wordpress.org/changeset/3097588 · Patch
• https://osv.dev/vulnerability/CVE-2024-2017 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-2017 · Security Note
• https://plugins.trac.wordpress.org/changeset/3096150 · Patch
• https://plugins.trac.wordpress.org/browser/countdown-builder/trunk/classes/Ajax.php#L51 · Note
• https://t.me/cvenotify/87377 · Telegram Post
• https://twitter.com/CVEnew/status/1798548127646990560 · Twitter Post
• https://twitter.com/StoykovStoyk/status/1838953949925179516 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1798592750079943135 · Twitter Post
• https://t.me/cvenotify/82146 · Telegram Post
• https://plugins.trac.wordpress.org/browser/countdown-builder/trunk/classes/Ajax.php#L92 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/d8fab229-cd6b-45a3-9e80-a03a1704ad3e?source=cve · Note