CVE-2024-9593

high · 8.3

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

The Time Clock plugin and Time Clock Pro plugin for WordPress are vulnerable to Remote Code Execution in versions up to, and including, 1.2.2 (for Time Clock) and 1.1.4 (for Time Clock Pro) via the 'etimeclockwp_load_function_callback' function. This allows unauthenticated attackers to execute code on the server. The invoked function's parameters cannot be specified.

8.3

CVSS

12.4%

EPSS (exploit prob.)

96th

EPSS percentile

2024-10-18

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Weaknesses

CWE-94

Affected products

Vendor	Product	Affected versions
wpplugin	time_clock	<= 1.1.4
wpplugin	time_clock	<= 1.2.2

Check a specific version with /api/v1/cve/match.

References

https://plugins.trac.wordpress.org/browser/time-clock/tags/1.2.2/includes/admin/ajax_functions_admin.php#L58
https://plugins.trac.wordpress.org/changeset/3171046/time-clock#file40
https://www.wordfence.com/threat-intel/vulnerabilities/id/247e599a-74e2-41d5-a1ba-978a807e6544?source=cve

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-9593