CVE-2026-124815: Clockinator Lite < 1.1.0 - Unauthenticated SQLi via Record Deletion Actions

Q: Who can exploit this issue?

Unauthenticated users can exploit the affected record deletion actions; no WordPress account or prior authentication is required.

Q: What access does an attacker need to perform the attack?

The attacker needs to be able to send requests to the vulnerable plugin's record deletion actions and control the table-name input used in the SQL query.

Q: What is the potential impact of successful exploitation?

An attacker can inject SQL, delete data from database tables, and extract sensitive information, including password hashes.

Q: Which installations are affected?

Clockinator Lite versions before 1.1.0 are affected. The provided information does not identify any configuration requirement or mitigation other than using a non-affected version.

Published Nov 12, 2026

Updated

The Clockinator Lite WordPress plugin before 1.1.0 does not restrict access to several of its record deletion actions, and uses a user-supplied table name in a SQL query without validating or escaping it, allowing unauthenticated users to perform SQL injection attacks, deleting data from any database table and extracting sensitive information such as password hashes.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Clockinator Lite to a version that resolves this vulnerability.
Fixed in 1.1.0

Event History

Nov 12, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Unauthenticated users can exploit the affected record deletion actions; no WordPress account or prior authentication is required.

What access does an attacker need to perform the attack?

The attacker needs to be able to send requests to the vulnerable plugin's record deletion actions and control the table-name input used in the SQL query.

What is the potential impact of successful exploitation?

An attacker can inject SQL, delete data from database tables, and extract sensitive information, including password hashes.

Which installations are affected?

Clockinator Lite versions before 1.1.0 are affected. The provided information does not identify any configuration requirement or mitigation other than using a non-affected version.

CVE-2026-124815: Clockinator Lite < 1.1.0 - Unauthenticated SQLi via Record Deletion Actions

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What access does an attacker need to perform the attack?

What is the potential impact of successful exploitation?

Which installations are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access does an attacker need to perform the attack?

What is the potential impact of successful exploitation?

Which installations are affected?