CVE-2025-2270

Summary

CVE-2025-2270 is a vulnerability affecting the Countdown, Coming Soon, Maintenance – Countdown & Clock plugin for WordPress. The issue lies in the plugin's createCdObj function, which is vulnerable to Local File Inclusion. This vulnerability allows unauthenticated attackers to include and execute files with specific filenames on the server. By exploiting this vulnerability, attackers can bypass access controls, obtain sensitive data, or even achieve code execution in some cases. The vulnerability exists in all versions up to and including 2.8.9.1.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.