The Ninja Countdown plugin for WordPress contains a missing capability check on the 'ninja_countdown_admin_ajax' AJAX endpoint in all versions up to and including 1.5.0. Because the endpoint does not verify the user’s role, any authenticated user with Subscriber level or higher can trigger a request that deletes an arbitrary countdown. The consequence is loss of user‑created countdown data, which could impact site functionality or advertising schedules, and represents a moderate data‑loss vulnerability per the CWE-862 classification.

WordPress sites running the Ninja Countdown | Fastest Countdown Builder plugin, version 1.5.0 or earlier, are affected.

The CVSS score of 4.3 reflects moderate severity, and an EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, and exploitation requires only an authenticated account at the Subscriber level or higher, which is commonly granted to regular site users. While the attack vector is relatively simple—sending a crafted AJAX request to delete a countdown—defenders should still prioritize remediation because the loss of countdown data can be disruptive to site operations.