---
id: "CVE-2026-124815"
page: "https://infrastack.ai/live/CVE-2026-124815"
kind: "vulnerability"
aliases: ["CVE-2026-124815"]
title: "Clockinator Lite WordPress plugin: unauthenticated SQL injection deletes and leaks database data"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["clockinator-lite", "package", "self-hosted", "wordpress"]
not_affected_if: ["plugin-not-installed", "version-1.1.0-or-later"]
published_at: "2026-11-12T06:17:13+00:00"
first_seen_at: "2026-11-12T06:36:54+00:00"
updated_at: "2026-11-12T06:37:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124815", "first_seen_at": "2026-11-12T06:36:54+00:00"}]
exploit_sources: []
---

# Clockinator Lite WordPress plugin: unauthenticated SQL injection deletes and leaks database data

Link for people: https://infrastack.ai/live/CVE-2026-124815 (this .md is for agents)

The Clockinator Lite WordPress plugin before 1.1.0 lets unauthenticated visitors trigger record deletion actions without access checks. It also builds a SQL query from a user-supplied table name without validation, so an attacker can delete data from any database table and extract sensitive values such as password hashes.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Clockinator Lite plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/` on the server.
- Confirm whether the site is running a version earlier than `1.1.0`.

## Fix

- Clockinator Lite: move to `1.1.0` or later (the sources state the fix is in versions before 1.1.0 being vulnerable).

## Timeline

- 2026-11-12T06:36:54+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124815

## From the sources

The Clockinator Lite WordPress plugin before 1.1.0 does not restrict access to several of its record deletion actions, and uses a user-supplied table name in a SQL query without validating or escaping it, allowing unauthenticated users to perform SQL injection attacks, deleting data from any database table and extracting sensitive information such as password hashes.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_