Redirect Countdown
Monthly
The Redirect Countdown WordPress plugin for all versions up to and including 1.0 contains a Cross-Site Request Forgery vulnerability in the countdown_settings_content() function due to missing nonce validation. An unauthenticated attacker can trick a site administrator into clicking a malicious link to modify critical plugin settings including countdown timeout, redirect URL, and custom text. With a CVSS score of 4.3 and network-accessible attack vector, this vulnerability has moderate real-world impact despite low baseline severity, as it directly affects site functionality and user experience.
The Redirect Countdown WordPress plugin for all versions up to and including 1.0 contains a Cross-Site Request Forgery vulnerability in the countdown_settings_content() function due to missing nonce validation. An unauthenticated attacker can trick a site administrator into clicking a malicious link to modify critical plugin settings including countdown timeout, redirect URL, and custom text. With a CVSS score of 4.3 and network-accessible attack vector, this vulnerability has moderate real-world impact despite low baseline severity, as it directly affects site functionality and user experience.