by Kastro
Paper/Archive/CVE-2026-124815

CVE-2026-124815

Unknown Clockinator Lite — Clockinator Lite < 1.1.0 - Unauthenticated SQLi via Record Deletion Actions

EPSS 0.2%CVSS 10.0
critical.is priorityof 100
32
CVSS 10.0 (ADP)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 7.4.074 × 201.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Clockinator Lite WordPress plugin before 1.1.0 does not restrict access to several of its record deletion actions, and uses a user-supplied table name in a SQL query without validating or escaping it, allowing unauthenticated users to perform SQL injection attacks, deleting data from any database table and extracting sensitive information such as password hashes.

Affected

ProductAffectedFixed inSource
Clockinator Lite< 1.1.01.1.0CNA

Scores by source

CISA ADP10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/a7fe2ca1-ddfe-45fa-93e2-e0959ae29256