PT-2026-145719

CVE-2026-124817

Published

2026-11-12

Updated

2026-11-12

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

The Clockinator Lite WordPress plugin before 1.1.0 does not check authorisation or ownership when updating leave requests, allowing unauthenticated users to modify any leave record, including approving or rejecting requests and reassigning them to other users.

Exploitability

Exploit

Fix

Impacts

Researchers

Claudio Marchesini

Dottor Marc

Enrico Marcolini

Vendors

Affected products

Weakness enumeration

CWE-284: Improper Access Control