{"id":"CVE-2026-124815","kind":"vulnerability","aliases":["CVE-2026-124815"],"related":[],"title":"Clockinator Lite WordPress plugin: unauthenticated SQL injection deletes and leaks database data","description":"The Clockinator Lite WordPress plugin before 1.1.0 does not restrict access to several of its record deletion actions, and uses a user-supplied table name in a SQL query without validating or escaping it, allowing unauthenticated users to perform SQL injection attacks, deleting data from any database table and extracting sensitive information such as password hashes.","summary":"The Clockinator Lite WordPress plugin before 1.1.0 lets unauthenticated visitors trigger record deletion actions without access checks. It also builds a SQL query from a user-supplied table name without validation, so an attacker can delete data from any database table and extract sensitive values such as password hashes.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["clockinator-lite","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","version-1.1.0-or-later"],"how_to_check":"- Check the installed Clockinator Lite plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/` on the server.\n- Confirm whether the site is running a version earlier than `1.1.0`.","fix":"- Clockinator Lite: move to `1.1.0` or later (the sources state the fix is in versions before 1.1.0 being vulnerable).","status":"open","published_at":"2026-11-12T06:17:13+00:00","first_seen_at":"2026-11-12T06:36:54+00:00","triaged_at":"2026-11-12T06:37:49+00:00","updated_at":"2026-11-12T06:37:49+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-12T06:37:49Z","model":"claude-haiku-5-5","output":{"fix":"- Clockinator Lite: move to `1.1.0` or later (the sources state the fix is in versions before 1.1.0 being vulnerable).","reach":"internet","title":"Clockinator Lite WordPress plugin: unauthenticated SQL injection deletes and leaks database data","impact":"high","summary":"The Clockinator Lite WordPress plugin before 1.1.0 lets unauthenticated visitors trigger record deletion actions without access checks. It also builds a SQL query from a user-supplied table name without validation, so an attacker can delete data from any database table and extract sensitive values such as password hashes.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","clockinator-lite","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Unauthenticated attacker deletes database tables and extracts password hashes.","analyst_note":"Confirm the exact affected version range and fixed release from the plugin's WordPress.org page or the NVD entry; the sources give only 'before 1.1.0'.","how_to_check":"- Check the installed Clockinator Lite plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/` on the server.\n- Confirm whether the site is running a version earlier than `1.1.0`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-1.1.0-or-later"],"who_is_affected":"Sites running the Clockinator Lite WordPress plugin before version 1.1.0 are exposed, because its deletion actions and SQL query handling are reachable without logging in. Any site that has the plugin installed, including one whose public pages do not use it, should be reviewed. Sites without this plugin installed are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000794,"input_tokens":4560,"output_tokens":676,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124815':15A,18A '-2026':14A,17A '1.1.0':33B,83C 'access':42B,87C 'action':40B,94C 'allow':112C 'also':45B 'attack':61B,119C 'build':46B 'check':43B 'clockin':1A,20B,28B,78C 'clockinator-lit':19B 'cve':13A,16A 'data':12A,64B,121C 'databas':11A,67B,124C 'delet':8A,39B,63B,93C,120C 'escap':110C 'extract':70B,127C 'hash':76B,133C 'host':25B 'inform':129C 'inject':7A,118C 'leak':10A 'let':34B 'lite':2A,21B,29B,79C 'name':56B,102C 'packag':22B 'password':75B,132C 'perform':116C 'plugin':4A,31B,81C 'queri':49B,106C 'record':38B,92C 'restrict':86C 'self':24B 'self-host':23B 'sensit':71B,128C 'sever':89C 'sql':6A,48B,105C,117C 'suppli':54B,100C 'tabl':55B,68B,101C,125C 'trigger':37B 'unauthent':5A,35B,113C 'use':96C 'user':53B,99C,114C 'user-suppli':52B,98C 'valid':58B,108C 'valu':72B 'visitor':36B 'without':41B,57B,107C 'wordpress':3A,26B,30B,80C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Clockinator Lite WordPress plugin before version 1.1.0 are exposed, because its deletion actions and SQL query handling are reachable without logging in. Any site that has the plugin installed, including one whose public pages do not use it, should be reviewed. Sites without this plugin installed are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["clockinatorlite","critical","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-124815':15A,18A '-2026':14A,17A 'clockin':1A 'cve':13A,16A 'data':12A 'databas':11A 'delet':8A 'inject':7A 'leak':10A 'lite':2A 'plugin':4A 'sql':6A 'unauthent':5A 'wordpress':3A","search_b":"'1.1.0':33B 'access':42B 'action':40B 'also':45B 'attack':61B 'build':46B 'check':43B 'clockin':20B,28B 'clockinator-lit':19B 'data':64B 'databas':67B 'delet':39B,63B 'extract':70B 'hash':76B 'host':25B 'let':34B 'lite':21B,29B 'name':56B 'packag':22B 'password':75B 'plugin':31B 'queri':49B 'record':38B 'self':24B 'self-host':23B 'sensit':71B 'sql':48B 'suppli':54B 'tabl':55B,68B 'trigger':37B 'unauthent':35B 'user':53B 'user-suppli':52B 'valid':58B 'valu':72B 'visitor':36B 'without':41B,57B 'wordpress':26B,30B","search_c":"'1.1.0':83C 'access':87C 'action':94C 'allow':112C 'attack':119C 'clockin':78C 'data':121C 'databas':124C 'delet':93C,120C 'escap':110C 'extract':127C 'hash':133C 'inform':129C 'inject':118C 'lite':79C 'name':102C 'password':132C 'perform':116C 'plugin':81C 'queri':106C 'record':92C 'restrict':86C 'sensit':128C 'sever':89C 'sql':105C,117C 'suppli':100C 'tabl':101C,125C 'unauthent':113C 'use':96C 'user':99C,114C 'user-suppli':98C 'valid':108C 'without':107C 'wordpress':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T06:17:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124815","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124815","severity":null,"published_at":"2026-11-12T06:17:13+00:00","modified_at":"2026-11-12T06:17:13+00:00","first_seen_at":"2026-11-12T06:36:54+00:00","fetched_at":"2026-11-12T06:36:54+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}