The CountDown Pro WP Plugin from LambertGroup has an SQL Injection flaw caused by insufficient input sanitization when building SQL statements. An attacker who supplies specially crafted input can inject arbitrary SQL, enabling the reading, modification or deletion of data stored in the WordPress database. This compromise affects the confidentiality, integrity and potentially the availability of site content and credentials.

All releases of the plugin version 2.7 and earlier are vulnerable. The issue resides in the "circular_countdown" component, which is commonly deployed on publicly accessible WordPress sites running any of the affected versions.

With a CVSS score of 8.5 the vulnerability is high severity, but the EPSS score of less than 1% indicates a low current exploitation probability. The likely attack vector involves sending a crafted HTTP request to the plugin’s endpoint, so any site exposing the plugin is at risk. The flaw is not listed in CISA’s KEV catalog, yet the potential impact warrants prompt action.