The Redirect Countdown WordPress plugin contains a CSRF flaw due to missing nonce validation in the countdown_settings_content() function. This flaw allows an unauthenticated attacker to forge a request that updates plugin settings, including the countdown timeout, redirect URL, and custom text. The attacker can therefore force the site to redirect visitors to a malicious URL or display deceptive messages, potentially resulting in phishing or other downstream attacks. The weakness is identified as CWE‑352, which represents a Cross‑Site Request Forgery scenario.

The issue affects the "Redirect Countdown" plugin developed by HAGHS, for all WordPress installations using version 1.0 or earlier. Administrators running these versions are at risk until the plugin is upgraded or removed.

With a CVSS score of 4.3, the vulnerability presents moderate severity. No EPSS data is available, and it is not listed in the KEV catalog. The attack path requires the attacker to coerce a legitimate site administrator to visit a crafted link or trigger the forged request. Because it exploits a CSRF weakness, the risk is bound to environments where administrators routinely click unfamiliar links. Nonetheless, the potential for undetected policy changes and malicious redirections warrants prompt attention.