WordPress Plugin Vulnerabilities

HurryTimer < 2.14.0 - Missing Authorization

Description

The HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.13.1. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
hurrytimer
Fixed in 2.14.0

References

CVE
CVE-2025-53255
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/61022086-608d-4980-ad8e-185bb59a707c

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
ch4r0n
Verified
No
WPVDB ID
87e1d2bf-8b68-4734-916b-e983a1e45de7

Timeline

Publicly Published
2025-06-27 (about 11 months ago)
Added
2025-07-01 (about 11 months ago)
Last Updated
2025-07-03 (about 11 months ago)

Other

Published
Title
Published
2025-11-26
Title
Reuters Direct <= 3.0.0 - Missing Authorization to Unauthenticated Settings Reset
Published
2025-06-19
Title
Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes <= 1.0.10 - Missing Authorization
Published
2025-01-21
Title
WP Hotel Booking < 2.1.7 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval
Published
2025-10-13
Title
SureForms – Drag and Drop Form Builder for WordPress < 1.12.2 - Missing Authorization to Authenticated (Contributor+) Information Disclosure
Published
2024-12-06
Title
Message Filter for Contact Form 7 < 1.6.3.1 - Subscriber+ Filter Creation