CVE-2024-2017 MEDIUM

CVE-2024-2017: Countdown, Coming Soon, Maintenance – Countdown & Clock <= 2.7.8 - Missing Authorization to Authenticated (Subscriber+) PHP Object Injection

Vendor Adamskaat
Product Countdown, Coming Soon, Maintenance – Countdown & Clock
Weakness CWE-862 · Missing authorization
Published June 6, 2024
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

The Countdown, Coming Soon, Maintenance – Countdown & Clock plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the conditionsRow and switchCountdown functions in all versions up to, and including, 2.7.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject PHP Objects and modify the status of countdowns.

Key dates

02Disclosure timeline

June 6, 2024 CVE published
April 8, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-45828 WordPress RumbleTalk Live Group Chat plugin <= 6.2.5 - Broken Access Control vulnerability CVE-2024-56271 WordPress WP SecureSubmit plugin <= 1.5.20 - Broken Access Control vulnerability CVE-2023-23988 WordPress My Tickets plugin <= 1.9.11 - Payment Bypass Vulnerability CVE-2026-33359 Meari unauthenticated alert image access in cloud object storage CVE-2025-14364 Demo Importer Plus <= 2.0.8 - Missing Authorization to Authenticated (Subscriber+) Site Reset and Privilege Escalation