CVE-2025-11758
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The All in One Time Clock Lite plugin for WordPress is vulnerable to unauthorized access due to a missing authorization check in all versions up to, and including, 2.0.3. The plugin exposes admin-level AJAX actions to unauthenticated users via wp_ajax_nopriv_ hooks, relying only on a nonce check without capability checks. This makes it possible for unauthenticated attackers to create published pages, create shift records with integrity issues, and download time reports containing PII (employee names and work schedules).
Risk Assessment
An unauthenticated attacker could create content, modify data, and access employee PII. This may lead to privacy breaches and data integrity issues.
Recommendation
Update the All in One Time Clock Lite plugin to a version above 2.0.3. Implement additional authorization checks and monitor for unusual AJAX activity.
Other vulnerabilities in All in One Time Clock Lite
Original NVD description (English source)
The All in One Time Clock Lite plugin for WordPress is vulnerable to unauthorized access due to a missing authorization check in all versions up to, and including, 2.0.3. This is due to the plugin exposing admin-level AJAX actions to unauthenticated users via wp_ajax_nopriv_ hooks, while relying only on a nonce check without capability checks. This makes it possible for unauthenticated attackers to create published pages, create shift records with integrity issues, and download time reports containing PII (employee names and work schedules).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS