CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
What the vulnerability does
The Countdown and CountUp, WooCommerce Sales Timers WordPress plugin is vulnerable to Cross-Site Request Forgery via the save_theme function found in the ~/includes/admin/coundown_theme_page.php file due to a missing nonce check which allows attackers to inject arbitrary web scripts, in versions up to and including 1.5.7.
Explanation of Vulnerability in Simple Terms
The Countdown and CountUp plugin for WooCommerce contains a cross-site request forgery (CSRF) vulnerability in version 1.5.7. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unauthorized actions on the site without the admin's knowledge or consent. This could allow modification of plugin settings or other administrative functions.
What an attacker can do
Perform unauthorized administrative actions on the site by tricking a logged-in admin into visiting a malicious webpage.
Potential impact on your site
An attacker can change plugin settings or perform other admin actions without your permission if you visit a compromised site while logged in.
Conditions required to exploit
A site administrator must visit a malicious webpage while logged into WordPress.
Key dates
External resources
Related vulnerabilities
