The HurryTimer – An Scarcity and Urgency Countdown Timer plugin for WordPress & WooCommerce suffers from a missing authorization check (CWE-862) in its activateCampaign() function. This flaw permits authenticated users with contributor-level privileges or higher to bypass intended post publication restrictions, allowing them to publish arbitrary posts such as those awaiting review or drafts. The vulnerability affects all versions up to 2.10.0. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low complexity, required privileges at the level of a contributor, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact.

An attacker with contributor-level access or higher can exploit this vulnerability to publish posts without proper authorization. This could lead to unauthorized content being published on the affected WordPress site, potentially impacting content integrity. There is no direct confidentiality or availability impact reported. No known active exploitation has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access carefully and monitor for unauthorized post publications. Avoid granting contributor or higher privileges to untrusted users. Follow updates from the plugin vendor or WordPress security advisories for an official patch.