Platform
wordpress
Component
time-clock
Fixed in
1.1.5
1.2.3
CVE-2024-9593 is a critical Remote Code Execution (RCE) vulnerability impacting the Time Clock and Time Clock Pro plugins for WordPress. This flaw allows unauthenticated attackers to execute code on a vulnerable server without needing credentials. The vulnerability affects versions up to 1.2.2 for Time Clock and 1.1.4 for Time Clock Pro. A patch has been released, and users are strongly advised to upgrade immediately.
The impact of this vulnerability is severe. An attacker can gain complete control of the WordPress server by exploiting this RCE. This could lead to data breaches, website defacement, malware installation, and potentially compromise other systems on the same network. Given the plugin's function (time tracking), sensitive employee data like salaries, hours worked, and personal information could be at risk. The lack of authentication requirements significantly lowers the barrier to entry for attackers, making this a high-priority vulnerability to address.
This vulnerability was publicly disclosed on 2024-10-18. While no active exploitation campaigns have been definitively confirmed, the ease of exploitation and the lack of authentication make it a likely target. No Proof of Concept (PoC) code has been publicly released, but the vulnerability's nature suggests that it is relatively straightforward to exploit. It is not currently listed on the CISA KEV catalog.
Exploit Status
EPSS
82.47% (99% percentile)
CISA SSVC
CVSS Vector
The primary mitigation is to upgrade the Time Clock and Time Clock Pro plugins to the latest available versions, which contain the fix. If immediate upgrading is not possible due to compatibility issues or breaking changes, consider temporarily disabling the plugins. Web Application Firewalls (WAFs) can be configured to block requests targeting the vulnerable 'etimeclockwploadfunction_callback' function. Regularly review WordPress plugin security and consider using a security scanner to identify and address potential vulnerabilities.
Actualice el plugin Time Clock a la última versión disponible. Esto solucionará la vulnerabilidad de ejecución remota de código.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2024-9593 is a Remote Code Execution vulnerability affecting the Time Clock and Time Clock Pro WordPress plugins, allowing attackers to execute code on the server without authentication.
You are affected if you are using Time Clock or Time Clock Pro versions 1.2.2 or earlier, or 1.1.4 or earlier, respectively. Check your plugin versions immediately.
Upgrade the Time Clock and Time Clock Pro plugins to the latest available versions. If upgrading is not immediately possible, disable the plugins temporarily.
While no confirmed active exploitation campaigns are known, the vulnerability's ease of exploitation makes it a likely target. Monitor your systems closely.
Refer to the plugin developer's website or WordPress plugin repository for the latest advisory and update information.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.