EUVD-2026-14004
GHSA-55wh-fv2f-g2fq
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
The Redirect countdown plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the countdown_settings_content() function. This makes it possible for unauthenticated attackers to update the plugin settings including the countdown timeout, redirect URL, and custom text, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
AnalysisAI
The Redirect Countdown WordPress plugin for all versions up to and including 1.0 contains a Cross-Site Request Forgery vulnerability in the countdown_settings_content() function due to missing nonce validation. An unauthenticated attacker can trick a site administrator into clicking a malicious link to modify critical plugin settings including countdown timeout, redirect URL, and custom text. With a CVSS score of 4.3 and network-accessible attack vector, this vulnerability has moderate real-world impact despite low baseline severity, as it directly affects site functionality and user experience.
Technical ContextAI
This vulnerability exploits improper request validation in the WordPress plugin architecture, specifically the failure to implement WordPress nonce (number used once) verification on the countdown_settings_content() function. The affected product is the Redirect Countdown plugin by Haghs (CPE: cpe:2.3:a:haghs:redirect_countdown:*:*:*:*:*:*:*:*), which is a WordPress plugin that manages countdown timers and redirects users after a specified duration. The root cause falls under CWE-352 (Cross-Site Request Forgery), a classic web vulnerability where state-changing operations lack cryptographic tokens. WordPress plugins typically handle settings via admin POST requests, and without proper nonce validation (a randomly-generated token unique to each session and action), any website can forge requests to modify plugin configuration when an administrator visits an attacker-controlled page. The vulnerability exists in the plugin code visible at the WordPress plugin repository trac browser endpoints, confirming the issue persists in the main trunk and 1.0 tag releases.
RemediationAI
Update the Redirect Countdown plugin to a patched version that includes nonce validation on the countdown_settings_content() function; check the WordPress plugin repository and the vendor's advisory for the recommended version number. If an immediate patch is unavailable, disable the plugin until a fix is released, or restrict access to the WordPress admin interface to known IP addresses using .htaccess or firewall rules to reduce the attack surface. Additionally, educate site administrators about CSRF attacks and suspicious links, and monitor plugin settings for unauthorized changes via audit logs. Verify the patch installation by reviewing the updated plugin code to confirm nonce verification is present on all state-changing admin actions.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' paramete
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today