CVE-2025-2270: LFI in Countdown WordPress Plugin

The LFI vulnerability in the Countdown plugin allows an attacker to execute arbitrary PHP code on the server. By manipulating the createCdObj function, an attacker can specify a file path to include, effectively reading and potentially executing any file accessible to the webserver user. This could lead to the disclosure of sensitive configuration files, database credentials, or even the complete takeover of the WordPress site. The impact is significant as it allows for code execution without authentication, enabling attackers to bypass access controls and escalate privileges. A successful exploit could result in data breaches, website defacement, and complete system compromise.

1. Reserved2025-03-12
2. Published2025-04-04
3. Modified2026-04-08
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-2270 is to immediately upgrade the Countdown, Coming Soon, Maintenance – Countdown & Clock plugin to version 2.8.10 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious file paths in the createCdObj parameter. Additionally, restrict file permissions on the WordPress server to minimize the potential impact of a successful exploit. After upgrading, verify the fix by attempting to access a non-existent file through the vulnerable parameter; the server should return a 404 error instead of including the file.

Active installs

10KKnown

Plugin rating