CVE-2026-124817

UNKNOWN 0.0

Clockinator Lite < 1.1.0 - Unauthenticated Leave Record Modification

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The Clockinator Lite WordPress plugin before 1.1.0 does not check authorisation or ownership when updating leave requests, allowing unauthenticated users to modify any leave record, including approving or rejecting requests and reassigning them to other users.

Vendor	unknown
Product	clockinator lite
Published	Nov 12, 2026

Stay Ahead of the Next One

Get instant alerts for unknown clockinator lite

Be the first to know when new unknown vulnerabilities affecting unknown clockinator lite are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / Clockinator Lite

0 < 1.1.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/31b79fe5-89ee-4ccf-b3c4-48ab46fa499c/

Credits

Enrico Marcolini Claudio Marchesini Dottor Marc WPScan