Easy Timer WordPress Plugin Remote Code Execution Vulnerability
Vulnerability
A remote code execution vulnerability exists in the Easy Timer plugin for WordPress, affecting all versions through 4.2.1. The issue arises from inadequate restrictions on shortcode attributes, allowing authenticated attackers with Editor-level access or higher to execute code on the server.
Impact
Exploitation of this vulnerability allows for remote code execution on the server where the affected WordPress site is hosted.
Remediation
Users are advised to update the Easy Timer plugin to version 4.2.2 or a newer patched version.
Added: Sep 4, 2025, 11:27 AM
Updated: Sep 4, 2025, 5:03 PM
Vulnerability Rating
Custom Algorithm
spread
0.0impact
10.0exploitability
5.9remediation
7.7relevance
0.5threat
3.2urgency
2.9incentive
1.7Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.