Description
The Countdown, Coming Soon, Maintenance – Countdown & Clock plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.9.1 via the createCdObj function. This makes it possible for unauthenticated attackers to include and execute files with the specific filenames on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in some cases.
Published: 2025-04-04
Score: 8.1 High
EPSS: 1.1% Low
KEV: No
Impact: Local File Inclusion with unauthenticated access can lead to code execution and data exposure
Action: Immediate Patch
AI Analysis

Impact

The Countdown, Coming Soon, Maintenance – Countdown & Clock plugin contains a Local File Inclusion flaw in the createCdObj function. Unauthenticated users can supply a path to an existing file on the server, causing the plugin to read and execute that file as PHP code. This gives the attacker the ability to run arbitrary PHP, bypass access controls, extract sensitive data, or establish persistence. The flaw is classified as CWE‑22.

Affected Systems

Any WordPress site using the Countdown, Coming Soon, Maintenance – Countdown & Clock plugin version 2.8.9.1 or earlier is affected. The plugin is distributed by adamskaat; all releases up to and including 2.8.9.1 contain the vulnerability. Newer releases should be verified for a fix.

Risk and Exploitability

The CVSS score is 8.1, indicating a high severity. The EPSS score is below 1 %, suggesting a low probability of current exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely a request that manipulates the createCdObj function’s input to include a file on the server, enabling unauthenticated remote code execution. Without remediation, the risk remains significant.

Generated by OpenCVE AI on April 20, 2026 at 23:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the plugin to a version newer than 2.8.9.1 that removes the LFI entry point.
  • If an update is not immediately possible, disable or delete the plugin to eliminate the vulnerable functionality.
  • Ensure that filesystem permissions for directories that could be targeted by the LFI are read‑only or otherwise restricted so that even if inclusion is triggered, no executable code can run.

Generated by OpenCVE AI on April 20, 2026 at 23:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-9695 The Countdown, Coming Soon, Maintenance – Countdown & Clock plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.9.1 via the createCdObj function. This makes it possible for unauthenticated attackers to include and execute files with the specific filenames on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in some cases.
History

Fri, 04 Apr 2025 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 04 Apr 2025 05:45:00 +0000

Type Values Removed Values Added
Description The Countdown, Coming Soon, Maintenance – Countdown & Clock plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.9.1 via the createCdObj function. This makes it possible for unauthenticated attackers to include and execute files with the specific filenames on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in some cases.
Title Countdown, Coming Soon, Maintenance – Countdown & Clock <= 2.8.9.1 - Unauthenticated Limited Local File Inclusion
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T17:20:05.019Z

Reserved: 2025-03-12T23:49:19.036Z

Link: CVE-2025-2270

cve-icon Vulnrichment

Updated: 2025-04-04T13:07:34.529Z

cve-icon NVD

Status : Deferred

Published: 2025-04-04T06:15:40.540

Modified: 2026-06-17T09:06:39.980

Link: CVE-2025-2270

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-20T23:30:16Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')