CVE-2023-3999
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
The Waiting: One-click countdowns plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on its AJAX calls in versions up to and including 0.6.2. This allows authenticated attackers with subscriber-level permissions and above to create and delete countdowns as well as manipulate other plugin settings.
Risk Assessment
Attackers can exploit this vulnerability to gain unauthorized control over countdowns and plugin settings, potentially leading to serious security breaches and data integrity loss.
Recommendation
It is recommended to update the plugin to the latest version to mitigate this vulnerability and to conduct an audit of user permissions within the system.
Original NVD description (English source)
The Waiting: One-click countdowns plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on its AJAX calls in versions up to, and including, 0.6.2. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to create and delete countdowns as well as manipulate other plugin settings.