CVE-2021-24633CWE-862

Countdown Block < 1.1.2 - Missing Authorisation in AJAX action

published September 27, 2021

CVSS
—
EPSS
1%
Percentile
51.4
In the wild
Unconfirmed
What it is

The Countdown Block WordPress plugin before 1.1.2 does not have authorisation in the eb_write_block_css AJAX action, which allows any authenticated user, such as Subscriber, to modify post contents displayed to users.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00671 · 51.4th percentile
Weakness
CWE-862 · Missing Authorization
Published
2021-09-27T15:25Z
EPSS history
Timeline
  • 27 SEP 15:25Z
    Countdown Block < 1.1.2 - Missing Authorisation in AJAX action
    cvelistv5