Local File Inclusion Vulnerability in Countdown Plugin for WordPress

CVE-2025-2270

What is CVE-2025-2270?

The Countdown, Coming Soon, Maintenance – Countdown & Clock plugin for WordPress contains a Local File Inclusion vulnerability due to improper handling in the createCdObj function. This flaw allows unauthenticated attackers to include and execute arbitrary server files, potentially leading to unauthorized access and execution of malicious PHP code. Exploitation of this vulnerability can facilitate bypassing access controls and may expose sensitive data.

References