---
id: "CVE-2026-124817"
page: "https://infrastack.ai/live/CVE-2026-124817"
kind: "vulnerability"
aliases: ["CVE-2026-124817"]
title: "Clockinator Lite WordPress plugin lets anyone edit leave requests"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["clockinator-lite", "package", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-12T06:17:13+00:00"
first_seen_at: "2026-11-12T06:36:54+00:00"
updated_at: "2026-11-12T06:37:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124817", "first_seen_at": "2026-11-12T06:36:54+00:00"}]
exploit_sources: []
---

# Clockinator Lite WordPress plugin lets anyone edit leave requests

Link for people: https://infrastack.ai/live/CVE-2026-124817 (this .md is for agents)

The Clockinator Lite WordPress plugin before 1.1.0 does not check who is making a leave request update. An unauthenticated visitor can approve, reject or reassign any leave record.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Clockinator Lite plugin in the WordPress admin under Plugins; a version below `1.1.0` is affected.

## Fix

- Clockinator Lite: `1.1.0` or later, per the advisory description.

## Timeline

- 2026-11-12T06:36:54+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124817

## From the sources

The Clockinator Lite WordPress plugin before 1.1.0 does not check authorisation or ownership when updating leave requests, allowing unauthenticated users to modify any leave record, including approving or rejecting requests and reassigning them to other users.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_