CVE-2023-28659: 
WordPress vulnerability analysis and mitigation

The Waiting: One-click Countdowns WordPress Plugin, version <= 0.6.2, is affected by an authenticated SQL injection vulnerability in the pbcdown[meta][id] parameter of the pbcsave_downs action. The vulnerability was discovered and reported by Joshua Martinelle of Tenable Research (Tenable Research).

The vulnerability exists due to improper sanitization of the pbcdown[meta][id] parameter in the pbcsave_downs AJAX action. The SQL injection vulnerability can be exploited by authenticated users, including those with low-privilege roles such as subscriber. The vulnerability has been assigned a CVSS v3.1 score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

If exploited, this vulnerability could allow authenticated attackers to execute arbitrary SQL commands on the underlying database. This could potentially lead to unauthorized access to sensitive data, modification of database contents, and compromise of the WordPress installation (WPScan).

As of December 19, 2022, the plugin has been closed and there is no official fix available. Users are advised to remove the plugin from their WordPress installations to mitigate the risk (Tenable Research).