CVE-2024-2017 is a missing authorization vulnerability (CWE-862) in the adamskaat Countdown, Coming Soon, Maintenance – Countdown & Clock WordPress plugin. The issue arises from absent capability checks in the conditionsRow and switchCountdown functions, allowing authenticated users with low privileges (subscriber and above) to perform unauthorized actions such as PHP object injection and modification of countdown statuses. The vulnerability affects all versions up to and including 2.7.8. The CVSS 3.1 base score is 5.4, indicating a medium severity level with network attack vector, low attack complexity, and no user interaction required.

An attacker with subscriber-level access or higher can inject PHP objects and modify countdown statuses without proper authorization. This could lead to unauthorized changes in plugin behavior or potential further exploitation depending on the injected payload. There is no indication of availability impact or known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, administrators should monitor the vendor's communications for updates. Until a fix is available, restrict subscriber-level access where possible and review user permissions to limit exposure.