CVE-2024-2017: 
WordPress vulnerability analysis and mitigation

The Countdown, Coming Soon, Maintenance – Countdown & Clock plugin for WordPress (versions up to 2.7.8) contains a vulnerability identified as CVE-2024-2017. This security flaw stems from a missing capability check on the conditionsRow and switchCountdown functions, which creates an unauthorized access vulnerability. The issue was discovered and reported by Wordfence, with initial disclosure on June 5, 2024 (NVD).

The vulnerability is characterized by a missing authorization mechanism (CWE-862) in the plugin's core functionality. It specifically affects the conditionsRow and switchCountdown functions, where the absence of proper capability checks enables unauthorized operations. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N (NVD).

When exploited, this vulnerability allows authenticated attackers with subscriber-level access or higher to inject PHP Objects and modify the status of countdowns. This could lead to unauthorized manipulation of countdown functionality and potential compromise of the affected WordPress installations (NVD).

The vulnerability requires an authenticated user with at least subscriber-level privileges to exploit. The attack complexity is considered low, requiring no user interaction, and can be executed remotely over the network (NVD).

Users are advised to update to version 2.7.8.1 or later of the Countdown Builder plugin, which contains the security fix for this vulnerability. The patch addresses the missing capability checks in the affected functions (NVD).