CVE-2025-6833

MediumCVSS 4.3

Published: 22/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

8th percentile - higher than 8% of all known CVEs

Summary

The All in One Time Clock Lite plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 2.0 via the 'aio_time_clock_lite_js' AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers with subscriber access and above to clock other users in and out.

Risk Assessment

The risk is the possibility of manipulating time tracking data of other users, potentially leading to falsified reports and data integrity breach.

Recommendation

Update the All in One Time Clock Lite plugin to a version that includes a fix for the key validation.

Other vulnerabilities in All in One Time Clock Lite

CVE-2025-11758Medium
The All in One Time Clock Lite plugin for WordPress is vulnerable to unauthorized access due to a missing authorization check in all versions up to, and including, 2.0.3. The plugin exposes admin-level AJAX actions to unauthenticated users via wp_ajax_nopriv_ hooks, relying only on a nonce check without capability checks. This makes it possible for unauthenticated attackers to create published pages, create shift records with integrity issues, and download time reports containing PII (employee names and work schedules).

Original NVD description (English source)

The All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0 via the 'aio_time_clock_lite_js' AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber access and above, to clock other users in and out.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS