{"id":"CVE-2026-124817","kind":"vulnerability","aliases":["CVE-2026-124817"],"related":[],"title":"Clockinator Lite WordPress plugin lets anyone edit leave requests","description":"The Clockinator Lite WordPress plugin before 1.1.0 does not check authorisation or ownership when updating leave requests, allowing unauthenticated users to modify any leave record, including approving or rejecting requests and reassigning them to other users.","summary":"The Clockinator Lite WordPress plugin before 1.1.0 does not check who is making a leave request update. An unauthenticated visitor can approve, reject or reassign any leave record.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["clockinator-lite","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the Clockinator Lite plugin in the WordPress admin under Plugins; a version below `1.1.0` is affected.","fix":"- Clockinator Lite: `1.1.0` or later, per the advisory description.","status":"open","published_at":"2026-11-12T06:17:13+00:00","first_seen_at":"2026-11-12T06:36:54+00:00","triaged_at":"2026-11-12T06:37:44+00:00","updated_at":"2026-11-12T06:37:44+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-12T06:37:44Z","model":"claude-haiku-5-5","output":{"fix":"- Clockinator Lite: `1.1.0` or later, per the advisory description.","reach":"internet","title":"Clockinator Lite WordPress plugin lets anyone edit leave requests","impact":"medium","summary":"The Clockinator Lite WordPress plugin before 1.1.0 does not check who is making a leave request update. An unauthenticated visitor can approve, reject or reassign any leave record.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","clockinator-lite"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Unauthenticated users approve, reject or reassign any leave record.","analyst_note":"","how_to_check":"- Check the installed version of the Clockinator Lite plugin in the WordPress admin under Plugins; a version below `1.1.0` is affected.\n- unknown for other checks.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Clockinator Lite WordPress plugin before 1.1.0 that use it for leave management. Sites without this plugin are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000683,"input_tokens":4530,"output_tokens":460,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124817':12A,15A '-2026':11A,14A '1.1.0':27B,55C 'allow':66C 'anyon':6A 'approv':42B,75C 'authoris':59C 'check':30B,58C 'clockin':1A,17B,22B,50C 'clockinator-lit':16B 'cve':10A,13A 'edit':7A 'includ':74C 'leav':8A,35B,47B,64C,72C 'let':5A 'lite':2A,18B,23B,51C 'make':33B 'modifi':70C 'ownership':61C 'packag':19B 'plugin':4A,25B,53C 'reassign':45B,80C 'record':48B,73C 'reject':43B,77C 'request':9A,36B,65C,78C 'unauthent':39B,67C 'updat':37B,63C 'user':68C,84C 'visitor':40B 'wordpress':3A,20B,24B,52C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Clockinator Lite WordPress plugin before 1.1.0 that use it for leave management. Sites without this plugin are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["clockinatorlite","high","package","wordpress"],"campaign_type":null,"search_a":"'-124817':12A,15A '-2026':11A,14A 'anyon':6A 'clockin':1A 'cve':10A,13A 'edit':7A 'leav':8A 'let':5A 'lite':2A 'plugin':4A 'request':9A 'wordpress':3A","search_b":"'1.1.0':27B 'approv':42B 'check':30B 'clockin':17B,22B 'clockinator-lit':16B 'leav':35B,47B 'lite':18B,23B 'make':33B 'packag':19B 'plugin':25B 'reassign':45B 'record':48B 'reject':43B 'request':36B 'unauthent':39B 'updat':37B 'visitor':40B 'wordpress':20B,24B","search_c":"'1.1.0':55C 'allow':66C 'approv':75C 'authoris':59C 'check':58C 'clockin':50C 'includ':74C 'leav':64C,72C 'lite':51C 'modifi':70C 'ownership':61C 'plugin':53C 'reassign':80C 'record':73C 'reject':77C 'request':65C,78C 'unauthent':67C 'updat':63C 'user':68C,84C 'wordpress':52C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T06:17:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124817","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124817","severity":null,"published_at":"2026-11-12T06:17:13+00:00","modified_at":"2026-11-12T06:17:13+00:00","first_seen_at":"2026-11-12T06:36:54+00:00","fetched_at":"2026-11-12T06:36:54+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}