Ninja Countdown WordPress Plugin Missing Authorization Vulnerability Allowing Arbitrary Countdown Deletion

A vulnerability exists in the Ninja Countdown | Fastest Countdown Builder plugin for WordPress, in all versions through 1.5.0. The issue arises from a missing capability check on the 'ninja_countdown_admin_ajax' AJAX endpoint, allowing authenticated attackers with Subscriber-level access and above to delete arbitrary countdowns.

Impact

Exploitation of this vulnerability allows for unauthorized deletion of countdowns by authenticated users with Subscriber-level access or higher.

Remediation

No known patch is available. It is recommended to review the vulnerability details and consider uninstalling the affected plugin.