The vulnerability is an improper limitation of a pathname to a restricted directory, allowing an attacker to traverse directories and include arbitrary files uploaded or accessed by the plugin. This Path Traversal flaw can lead to Remote Code Inclusion, enabling an attacker to execute arbitrary code on the affected WordPress site. The weakness is classified as CWE‑22 and carries a severity of 9.9 on the CVSS scale, indicating critical impact on confidentiality, integrity, and availability of the host system.

WordPress installations that have the adamskaat Countdown & Clock plugin version 2.8.8 or older are affected. No specific patch versions are listed as fixed in the data; the issue is present up to 2.8.8.

The EPSS score is below 1 %, suggesting a low probability of exploitation in the current environment. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via a web request to the plugin that allows arbitrary file paths, implying that an attacker would need network access to the WordPress site and would exploit the plugin’s file handling logic. With a CVSS of 9.9, the risk is high, and the exploitation would grant an attacker full control of the web server.