WordPress Countdown & Clock Plugin Path Traversal Vulnerability Leading to Remote Code Execution

A path traversal vulnerability allowing remote code execution has been identified in the WordPress Countdown & Clock plugin, specifically in versions through 2.8.8. This vulnerability arises from improper restrictions on pathname navigation, which could be exploited to include malicious code remotely.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected website, potentially leading to unauthorized access and control over the site.

Remediation

Users of the WordPress Countdown & Clock plugin should update to version 2.8.9 or later. Patchstack users can enable auto-updates for vulnerable plugins.