CVE-2026-124817: Clockinator Lite < 1.1.0 - Unauthenticated Leave Record Modification

Q: Who can exploit this issue?

An unauthenticated user can exploit it. No login, authorization, or ownership of the targeted leave record is required.

Q: What actions can an attacker perform on leave records?

An attacker can modify any leave record, including approving or rejecting leave requests and reassigning requests to other users.

Q: Which plugin versions are affected?

Clockinator Lite versions before 1.1.0 are affected.

Published Nov 12, 2026

Updated

The Clockinator Lite WordPress plugin before 1.1.0 does not check authorisation or ownership when updating leave requests, allowing unauthenticated users to modify any leave record, including approving or rejecting requests and reassigning them to other users.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Clockinator Lite to a version that resolves this vulnerability.
Fixed in 1.1.0

Event History

Nov 12, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An unauthenticated user can exploit it. No login, authorization, or ownership of the targeted leave record is required.

What actions can an attacker perform on leave records?

An attacker can modify any leave record, including approving or rejecting leave requests and reassigning requests to other users.

Which plugin versions are affected?

Clockinator Lite versions before 1.1.0 are affected.

CVE-2026-124817: Clockinator Lite < 1.1.0 - Unauthenticated Leave Record Modification

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What actions can an attacker perform on leave records?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What actions can an attacker perform on leave records?

Which plugin versions are affected?