CVE-2023-4000
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Waiting: One-click countdowns plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 0.6.2. This is due to missing or incorrect nonce validation on its AJAX actions, allowing unauthenticated attackers to create and delete countdowns.
Risk Assessment
Attackers can exploit this vulnerability to manipulate countdowns, potentially leading to loss of user trust and financial losses for the organization.
Recommendation
It is recommended to update the plugin to the latest version to mitigate this vulnerability and implement additional security measures such as proper nonce validation.
Original NVD description (English source)
The Waiting: One-click countdowns plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.6.2. This is due to missing or incorrect nonce validation on its AJAX actions. This makes it possible for unauthenticated attackers to create and delete countdowns, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.