WordPress CVEs

Description

The Countdown Block WordPress plugin before 1.1.2 does not have authorisation in the eb_write_block_css AJAX action, which allows any authenticated user, such as Subscriber, to modify post contents displayed to users.

Affected WordPress components

• Countdown Block Plugin · countdown-block
  Possible match Active
  From 1.1.2 (including) to 1.1.2 (excluding)
  View on WordPress.org
• Countdown Block Plugin · wp-countdown-block
  Possible match Abandoned
  From 1.1.2 (including) to 1.1.2 (excluding)
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• Unknown Countdown Block — From 1.1.2 (including) to 1.1.2 (excluding)
• wpdeveloper countdown_block — Before 1.1.2

References

• wpscan.com https://wpscan.com/vulnerability/431901eb-0f95-4033-b943-324e6d3844a5 Exploit, Third Party Advisory
• nvd.nist.gov Official NVD record