CVE-2024-2017

The Countdown, Coming Soon, Maintenance – Countdown & Clock plugin for WordPress contains a capability check vulnerability that affects versions up to 2.7.8. Authenticated attackers with subscriber-level permissions or higher can exploit missing security controls in the conditionsRow and switchCountdown functions to inject PHP objects and alter countdown statuses. The vulnerability requires an authenticated account but no elevated privileges, making it accessible to low-level users.

Based on public CVE data (MITRE/NVD).