CVE-2024-2017 – This vulnerability in the WordPress Countdown &... (How to Fix)

Q: What is the severity of CVE-2024-2017?

CVE-2024-2017 has a CVSS score of 5.4 (MEDIUM). This vulnerability in the WordPress Countdown & Clock plugin allows authenticated attackers with subscriber-level access or higher to inject PHP objects and modify countdown statuses. It affects all plugin versions up to 2.7.8 due to missing capability checks in two functions. WordPress sites using this plugin are vulnerable if they have any registered users.

📋 TL;DR

This vulnerability in the WordPress Countdown & Clock plugin allows authenticated attackers with subscriber-level access or higher to inject PHP objects and modify countdown statuses. It affects all plugin versions up to 2.7.8 due to missing capability checks in two functions. WordPress sites using this plugin are vulnerable if they have any registered users.

💻 Affected Systems

Products:

Countdown, Coming Soon, Maintenance – Countdown & Clock WordPress plugin

Versions: All versions up to and including 2.7.8

Operating Systems: All operating systems running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires at least one authenticated user account (subscriber role or higher). Fresh WordPress installations with this plugin are vulnerable by default.

📦 What is this software?

Countdown Builder by Edmonsoft

View all CVEs affecting Countdown Builder →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could achieve remote code execution by injecting malicious PHP objects, potentially leading to complete site compromise, data theft, or malware installation.

🟠

Likely Case

Attackers modify countdown settings or inject limited PHP objects to disrupt site functionality or gain elevated privileges.

🟢

If Mitigated

With proper user access controls and monitoring, impact is limited to unauthorized countdown modifications.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires authenticated access but is straightforward once authenticated. PHP object injection can lead to various secondary attacks.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.7.9

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3097588/

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Countdown, Coming Soon, Maintenance – Countdown & Clock'. 4. Click 'Update Now' if update is available. 5. Alternatively, download version 2.7.9+ from WordPress plugin repository and manually update.

🔧 Temporary Workarounds

Disable vulnerable plugin

all

Temporarily deactivate the plugin until patched

wp plugin deactivate countdown-builder

Restrict user registration

all

Disable new user registrations to limit attack surface

Settings → General → Membership: Uncheck 'Anyone can register'

🧯 If You Can't Patch

Implement strict user access controls and monitor subscriber-level accounts
Deploy web application firewall rules to block requests to vulnerable Ajax endpoints

🔍 How to Verify

Check if Vulnerable:

Check plugin version in WordPress admin under Plugins → Installed Plugins. If version is 2.7.8 or lower, you are vulnerable.

Check Version:

wp plugin get countdown-builder --field=version

Verify Fix Applied:

Verify plugin version is 2.7.9 or higher. Test authenticated user access to countdown modification functions.

📡 Detection & Monitoring

Log Indicators:

Unusual POST requests to /wp-admin/admin-ajax.php with action=conditionsRow or action=switchCountdown from subscriber accounts
PHP object injection attempts in request parameters

Network Indicators:

HTTP requests to vulnerable Ajax endpoints from authenticated sessions
Unexpected countdown status changes

SIEM Query:

source="wordpress.log" AND (uri_path="/wp-admin/admin-ajax.php" AND (param_action="conditionsRow" OR param_action="switchCountdown"))

📊 Metadata

CVE ID: CVE-2024-2017

CVSS v3 Score: 5.4 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CWE: CWE-862

Published: June 6, 2024

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-2017, you might also want to check these: