CVE-2024-9593CWE-94

Time Clock <= 1.2.2 & Time Clock Pro <= 1.1.4 - Unauthenticated (Limited) Remote Code Execution

High · published October 18, 2024

CVSS v3.1
8.3
EPSS
12%
Percentile
96.2
In the wild
Unconfirmed
What it is

The Time Clock plugin and Time Clock Pro plugin for WordPress are vulnerable to Remote Code Execution in versions up to, and including, 1.2.2 (for Time Clock) and 1.1.4 (for Time Clock Pro) via the 'etimeclockwp_load_function_callback' function. This allows unauthenticated attackers to execute code on the server. The invoked function's parameters cannot be specified.

The record
Technical detail
CVSS v3.1
8.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.12411 · 96.2th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2024-10-18T17:32Z
EPSS history
Timeline
  • 18 OCT 17:32Z
    Time Clock <= 1.2.2 & Time Clock Pro <= 1.1.4 - Unauthenticated (Limited) Remote Code Execution
    cvelistv5