WordPress Countdown Plugin Local File Inclusion Vulnerability

A local file inclusion vulnerability has been identified in the Countdown, Coming Soon, Maintenance – Countdown & Clock plugin for WordPress, affecting all versions through 2.8.9.1. The vulnerability arises in the createCdObj function, where unauthenticated attackers can include and execute files from the server with specific filenames. This exploitation allows the execution of PHP code contained in those files, potentially bypassing access controls, accessing sensitive information, or in some cases, executing arbitrary code.

Impact

Exploitation of this vulnerability could lead to unauthorized file inclusion, allowing attackers to execute PHP code on the server. This could be used to bypass access controls, access sensitive data, or achieve remote code execution.

Remediation

Users are advised to update the Countdown, Coming Soon, Maintenance – Countdown & Clock plugin to version 2.9.0 or later.