CVE-2026-124815 · Package
NO FIX YET · SEE WHAT TO DO
The Clockinator Lite WordPress plugin before 1.1.0 lets unauthenticated visitors trigger record deletion actions without access checks. It also builds a SQL query from a user-supplied table name without validation, so an attacker can delete data from any database table and extract sensitive values such as password hashes.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the Clockinator Lite WordPress plugin before version 1.1.0 are exposed, because its deletion actions and SQL query handling are reachable without logging in. Any site that has the plugin installed, including one whose public pages do not use it, should be reviewed. Sites without this plugin installed are not affected.
Not affected if plugin-not-installed, version-1.1.0-or-later
Who cares clockinator-lite, self-hosted, wordpress
wp-content/plugins/ on the server.1.1.0.1.1.0 or later (the sources state the fix is in versions before 1.1.0 being vulnerable).The Clockinator Lite WordPress plugin before 1.1.0 does not restrict access to several of its record deletion actions, and uses a user-supplied table name in a SQL query without validating or escaping it, allowing unauthenticated users to perform SQL injection attacks, deleting data from any database table and extracting sensitive information such as password hashes.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.