EUVD-2026-14004
GHSA-55wh-fv2f-g2fq
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Redirect countdown plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the countdown_settings_content() function. This makes it possible for unauthenticated attackers to update the plugin settings including the countdown timeout, redirect URL, and custom text, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
AnalysisAI
The Redirect Countdown WordPress plugin for all versions up to and including 1.0 contains a Cross-Site Request Forgery vulnerability in the countdown_settings_content() function due to missing nonce validation. An unauthenticated attacker can trick a site administrator into clicking a malicious link to modify critical plugin settings including countdown timeout, redirect URL, and custom text. With a CVSS score of 4.3 and network-accessible attack vector, this vulnerability has moderate real-world impact despite low baseline severity, as it directly affects site functionality and user experience.
Technical ContextAI
This vulnerability exploits improper request validation in the WordPress plugin architecture, specifically the failure to implement WordPress nonce (number used once) verification on the countdown_settings_content() function. The affected product is the Redirect Countdown plugin by Haghs (CPE: cpe:2.3:a:haghs:redirect_countdown:*:*:*:*:*:*:*:*), which is a WordPress plugin that manages countdown timers and redirects users after a specified duration. The root cause falls under CWE-352 (Cross-Site Request Forgery), a classic web vulnerability where state-changing operations lack cryptographic tokens. WordPress plugins typically handle settings via admin POST requests, and without proper nonce validation (a randomly-generated token unique to each session and action), any website can forge requests to modify plugin configuration when an administrator visits an attacker-controlled page. The vulnerability exists in the plugin code visible at the WordPress plugin repository trac browser endpoints, confirming the issue persists in the main trunk and 1.0 tag releases.
RemediationAI
Update the Redirect Countdown plugin to a patched version that includes nonce validation on the countdown_settings_content() function; check the WordPress plugin repository and the vendor's advisory for the recommended version number. If an immediate patch is unavailable, disable the plugin until a fix is released, or restrict access to the WordPress admin interface to known IP addresses using .htaccess or firewall rules to reduce the attack surface. Additionally, educate site administrators about CSRF attacks and suspicious links, and monitor plugin settings for unauthorized changes via audit logs. Verify the patch installation by reviewing the updated plugin code to confirm nonce verification is present on all state-changing admin actions.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today