CVE-2026-124815
Clockinator Lite < 1.1.0 - Unauthenticated SQLi via Record Deletion Actions
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Clockinator Lite WordPress plugin before 1.1.0 does not restrict access to several of its record deletion actions, and uses a user-supplied table name in a SQL query without validating or escaping it, allowing unauthenticated users to perform SQL injection attacks, deleting data from any database table and extracting sensitive information such as password hashes.
| Vendor | unknown |
| Product | clockinator lite |
| Published | Nov 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown clockinator lite
Be the first to know when new unknown vulnerabilities affecting unknown clockinator lite are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Clockinator Lite
0 < 1.1.0
References
Credits
Muni Nitish Kumar Yaddala WPScan