CVE-2026-111034

Countdown, Coming Soon, Maintenance – Countdown & Clock <= 3.0.8 - Subscriber+ Non-Public Post Title Disclosure via select2Ajax

View on CVE.org
Published Nov 14, 2026 CVSS n/a EPSS n/a KEV · Not listed
Description
The Countdown, Coming Soon, Maintenance WordPress plugin through 3.0.8 does not check that the user is allowed to browse content before returning post titles from one of its AJAX actions, allowing any authenticated user, such as a subscriber, to list the titles of published entries of any post type, including types that WordPress does not expose to them. Draft, private and pending content is not returned; only published entries are disclosed.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Description The Countdown, Coming Soon, Maintenance WordPress plugin through 3.0.8 does not check that the user is allowed to browse content before returning post titles from one of its AJAX actions, allowing any authenticated user, such as a subscriber, to list the titles of published entries of any post type, including types that WordPress does not expose to them. Draft, private and pending content is not returned; only published entries are disclosed.
Title Countdown, Coming Soon, Maintenance – Countdown & Clock <= 3.0.8 - Subscriber+ Non-Public Post Title Disclosure via select2Ajax
References

Subscriptions

No data.

Weaknesses

No weakness.

Sources

Status
PUBLISHED
Assigner
WPScan
Published
Updated
Nov 14, 2026, 6:00 AM
Reserved
Oct 15, 2026, 12:21 PM

View source JSON

No data.

No data.

No data.

No data.