Vulnerability · Published Oct 18, 2024 · Assigned by Wordfence
CVE-2024-9593Time Clock <= 1.2.2 & Time Clock Pro <= 1.1.4 - Unauthenticated (Limited) Remote Code Execution
High 8.3
In plain English
A high-severity code injection in Time Clock Pro from Scott Paterson. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 12.4% (higher than 96% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.
Official description
The Time Clock plugin and Time Clock Pro plugin for WordPress are vulnerable to Remote Code Execution in versions up to, and including, 1.2.2 (for Time Clock) and 1.1.4 (for Time Clock Pro) via the 'etimeclockwp_load_function_callback' function. This allows unauthenticated attackers to execute code on the server. The invoked function's parameters cannot be specified.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Scott Paterson | Time Clock Pro | 0 – through 1.1.4 |
| scottpaterson | Time Clock – A WordPress Employee & Volunteer Time Clock Plugin | 0 – through 1.2.2 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L