CVE-2026-1390: 
WordPress vulnerability analysis and mitigation

CVE-2026-1390 is a Cross-Site Request Forgery (CSRF) vulnerability in the "Redirect countdown" plugin for WordPress, affecting all versions up to and including 1.0. The flaw allows unauthenticated attackers to modify plugin settings — including the countdown timeout, redirect URL, and custom text — by tricking a site administrator into clicking a malicious link. It was published on March 21, 2026, and assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (Wordfence, EUVD).

The root cause is missing nonce validation in the countdown_settings_content() function of the plugin (CWE-352: Cross-Site Request Forgery). Because the function does not verify a WordPress nonce before processing form submissions, an attacker can craft a forged HTTP request that, when triggered by an authenticated administrator, updates plugin settings without authorization. The vulnerable code is visible in the plugin's source at line 34 of redirectcountdown.php. No authentication is required on the attacker's side; only the victim administrator's browser session is needed to complete the attack (Wordfence, Plugin Source).

Successful exploitation allows an attacker to alter the plugin's redirect URL, countdown timeout, and custom display text on the affected WordPress site. The most significant risk is redirect hijacking — an attacker could point the countdown redirect to a malicious or phishing site, potentially exposing site visitors to further attacks. Confidentiality and availability are not directly impacted; the primary consequence is a low-severity integrity impact limited to the plugin's configuration (Wordfence).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires social engineering to trick an administrator into clicking a crafted link, which limits its practical exploitability (Wordfence).

1. Reconnaissance: Identify a WordPress site running the "Redirect countdown" plugin version 1.0 or earlier, which can be detected via the plugin's readme or source files exposed at /wp-content/plugins/redirect-countdown/.
2. Craft malicious request: Construct an HTML page or link containing a hidden form that submits a POST request to the target WordPress admin endpoint (e.g., wp-admin/options-general.php?page=redirect-countdown) with attacker-controlled values for the redirect URL, countdown timeout, and custom text fields.
3. Social engineering: Deliver the malicious link or page to a logged-in site administrator via email, chat, or another channel, enticing them to click it.
4. CSRF execution: When the administrator's browser loads the attacker's page, the hidden form auto-submits, sending a forged request authenticated by the administrator's active session cookie — bypassing the missing nonce check in countdown_settings_content().
5. Achieve objective: The plugin settings are updated with the attacker's values (e.g., redirect URL changed to a phishing site), causing site visitors who encounter the countdown to be redirected to the malicious destination (Wordfence, Plugin Source).

• Logs: WordPress admin access logs showing unexpected POST requests to the plugin settings page (e.g., wp-admin/options-general.php?page=redirect-countdown) from unusual referrer origins or at unusual times.
• File System / Database: Changes to the plugin's stored settings in the WordPress wp_options table — specifically unexpected modifications to the redirect URL, countdown timeout, or custom text values associated with the "Redirect countdown" plugin.
• Network: Outbound redirects from the WordPress site to unfamiliar or suspicious external domains that were not previously configured by the site administrator.

Site administrators should check whether a patched version of the "Redirect countdown" plugin (beyond version 1.0) has been released and update immediately if available. If no patch is available, the recommended workaround is to deactivate and remove the plugin until a fix is provided. Additionally, administrators should review current plugin settings to ensure the redirect URL has not been tampered with. General WordPress hardening — such as using security plugins that add CSRF protections and being cautious about clicking unsolicited links while logged into the admin panel — can reduce exposure (Wordfence).