CVE-2026-124817 PUBLISHED

Clockinator Lite < 1.1.0 - Unauthenticated Leave Record Modification

Assigner: WPScan
Reserved: 09.11.2026 Published: 12.11.2026 Updated: 12.11.2026

The Clockinator Lite WordPress plugin before 1.1.0 does not check authorisation or ownership when updating leave requests, allowing unauthenticated users to modify any leave record, including approving or rejecting requests and reassigning them to other users.

Product Status

Vendor Unknown
Product Clockinator Lite
Versions Default: unaffected
  • affected from 0 to 1.1.0 (excl.)

Credits

  • Enrico Marcolini finder
  • Claudio Marchesini finder
  • Dottor Marc finder
  • WPScan coordinator

References

Problem Types

  • CWE-284 Improper Access Control CWE