CVE-2023-3999

Name of the Vulnerable Software and Affected Versions The Waiting: One-click countdowns plugin for WordPress versions up to, and including, 0.6.2

Description The issue is related to authorization bypass due to missing capability checks on AJAX calls. This allows authenticated attackers with subscriber-level permissions and above to create and delete countdowns, as well as manipulate other plugin settings.

Recommendations For versions up to, and including, 0.6.2, update to a version that includes the necessary capability checks on AJAX calls to prevent authorization bypass.