What the vulnerability does
01Description
The HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized post publication due to a missing capability check on the activateCampaign() function in all versions up to, and including, 2.10.0. This makes it possible for authenticated attackers, with contributor-level access and above, to publish arbitrary posts like ones they have submitted for review, or a site administrator has in draft.
Explanation of Vulnerability in Simple Terms
02Summary
The HurryTimer WordPress plugin through version 2.10.0 lacks proper authorization checks on certain administrative functions. A logged-in user with low privileges can modify plugin settings without proper permission verification. This allows unauthorized changes to countdown timer configurations that may affect site functionality or user experience.
What an attacker can do
03Attacker Capabilities
Modify HurryTimer plugin settings without proper authorization.
Potential impact on your site
04Site Impact
Unauthorized users can alter countdown timer behavior, potentially disrupting sales urgency tactics or customer experience.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
06Disclosure timeline
October 24, 2024
CVE published
April 8, 2026
Record updated
