CVE-2026-1390 is a CSRF vulnerability in the Redirect countdown WordPress plugin caused by the absence of nonce validation in the countdown_settings_content() function. This enables attackers to submit forged requests that modify plugin settings if an administrator is tricked into interacting with a malicious link or page. The vulnerability affects all versions up to and including 1.0. The CVSS 3.1 base score is 4.3 (medium severity), reflecting low complexity and no privileges required but requiring user interaction. No patch or remediation information is currently available.

An attacker can cause an authenticated administrator to unknowingly change plugin settings, potentially altering the countdown timeout, redirect URL, or custom text. This could lead to undesired redirects or misleading content being presented to users. There is no direct confidentiality or availability impact reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution when clicking on untrusted links and consider restricting administrative access or using security plugins that provide CSRF protections.