CVE-2026-111034: Countdown, Coming Soon, Maintenance – Countdown & Clock <= 3.0.8 - Subscriber+ Non-Public Post Title Disclosure via select2Ajax

Q: Who can exploit this issue?

Any authenticated WordPress user can exploit it, including users with the Subscriber role. The attacker needs only a valid account; no elevated content-browsing permission is required for the affected AJAX action.

Q: What information can be disclosed?

The issue discloses titles of published entries across post types, including post types that are not normally exposed to the requesting user. It does not return titles for draft, private, or pending content.

Q: Are sites without public registration affected?

The issue requires authentication, so exposure depends on whether untrusted users can obtain or use WordPress accounts. Sites where only trusted administrators and authors have accounts have a smaller practical exposure than sites with subscriber accounts or other low-privilege users.

Published Nov 14, 2026

Updated

The Countdown, Coming Soon, Maintenance WordPress plugin through 3.0.8 does not check that the user is allowed to browse content before returning post titles from one of its AJAX actions, allowing any authenticated user, such as a subscriber, to list the titles of published entries of any post type, including types that WordPress does not expose to them. Draft, private and pending content is not returned; only published entries are disclosed.

Affected Software

0 affected components

Event History

Nov 14, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Any authenticated WordPress user can exploit it, including users with the Subscriber role. The attacker needs only a valid account; no elevated content-browsing permission is required for the affected AJAX action.

What information can be disclosed?

The issue discloses titles of published entries across post types, including post types that are not normally exposed to the requesting user. It does not return titles for draft, private, or pending content.

Are sites without public registration affected?

The issue requires authentication, so exposure depends on whether untrusted users can obtain or use WordPress accounts. Sites where only trusted administrators and authors have accounts have a smaller practical exposure than sites with subscriber accounts or other low-privilege users.