CVE-2024-9593: Time Clock <= 1.2.2 & Time Clock Pro <= 1.1.4 - Unauthenticated (Limited) Remote Code Execution
The Time Clock plugin and Time Clock Pro plugin for WordPress are vulnerable to Remote Code Execution in versions up to, and including, 1.2.2 (for Time Clock) and 1.1.4 (for Time Clock Pro) via the 'etimeclockwploadfunctioncallback' function. This allows unauthenticated attackers to execute code on the server. The invoked function's parameters cannot be specified.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9593?
CVE-2024-9593 is identified as a critical vulnerability due to the potential for remote code execution.
How do I fix CVE-2024-9593?
To address CVE-2024-9593, upgrade the Time Clock plugin to version 1.2.3 or higher and the Time Clock Pro plugin to version 1.1.5 or higher.
What plugins are affected by CVE-2024-9593?
CVE-2024-9593 affects the Time Clock plugin versions up to and including 1.2.2 and the Time Clock Pro plugin versions up to and including 1.1.4.
Can CVE-2024-9593 be exploited remotely?
Yes, CVE-2024-9593 can be exploited remotely by unauthenticated attackers due to the vulnerability in the 'etimeclockwp_load_function_callback' function.
What type of vulnerability is CVE-2024-9593?
CVE-2024-9593 is classified as a remote code execution vulnerability.