CVE-2026-124815— Clockinator Lite < 1.1.0 - Unauthenticated SQLi via Record Deletion Actions

Quick assessment

Affected

Unknown Clockinator Lite

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Clockinator Lite WordPress 插件在 1.1.0 版本之前未对多个记录删除操作实施访问限制，并在 SQL 查询中直接使用用户提供的表名，且未对其进行验证或转义。这使得未经认证的攻击者能够实施 SQL 注入攻击，删除任意数据库表中的数据，并提取敏感信息（例如密码哈希值）。

AI Predicted 9.8 Difficulty: Trivial Updated Nov 12, 2026

Possible ATT&CK Techniques 3 AI

T1003 · OS Credential Dumping T1070.004 · File Deletion T1190 · Exploit Public-Facing Application

Updated Nov 12, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Clockinator Lite < 1.1.0 - Unauthenticated SQLi via Record Deletion Actions

Source: CVE Program / CVE List V5

Vulnerability Description

The Clockinator Lite WordPress plugin before 1.1.0 does not restrict access to several of its record deletion actions, and uses a user-supplied table name in a SQL query without validating or escaping it, allowing unauthenticated users to perform SQL injection attacks, deleting data from any database table and extracting sensitive information such as password hashes.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Unknown	Clockinator Lite	0 ~ 1.1.0	-

II. Public POCs for CVE-2026-124815

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-124815

请登录查看更多情报信息。

Other References for CVE-2026-124815 (1)

https://wpscan.com/vulnerability/a7fe2ca1-ddfe-45fa-93e2-e0959ae29256/ exploit vdb-entry technical-description

https://www.cve.org/CVERecord?id=CVE-2026-124815

Same Patch Batch · Unknown · 2026-11-12 · 21 CVEs total

CVE-2026-122003		Abilities Bridge < 1.4.2 - Administrator Account Creation via CSRF
CVE-2026-110072		Photo Gallery by 10Web < 1.8.49 - Contributor+ Stored XSS via watermark_url Shortcode Attr
CVE-2026-110041		Crop-Thumbnails < 1.10.0 - Author+ Arbitrary Attachment Read and Overwrite via crop REST E
CVE-2026-106027		Oxygen MyData for WooCommerce 3.0.0 - 3.0.8 - Unauthenticated Arbitrary Order Completion v
CVE-2026-110959		Descope < 1.2.0 - Unauthenticated Account Takeover
CVE-2026-119039		Defender Security 4.9.0 - 6.4.0 - Unauthenticated IP Address Spoofing via Smart IP Detecti
CVE-2026-118421		WP Directory Kit < 1.6.3 - Listing Admin+ SQL Injection via 'order_by' Parameter
CVE-2026-118531		Directorist < 8.11.1 - Subscriber+ Listing Moderation Bypass via REST Status Update
CVE-2026-123044		ContentPen < 1.1.1 - Unauthenticated Stored XSS via API Key Disclosure
CVE-2026-119040		Defender Security < 6.4.1 - 2FA Bypass via Unthrottled OTP Verification
CVE-2026-76792		User Verification 2.0.38 - 2.0.48 - Unauthenticated Account Takeover via Unthrottled OTP L
CVE-2026-121498		Askany < 2.2.1 - Unauthenticated Chat Session Disclosure and Modification via IDOR
CVE-2026-123092		WP Remote Users Sync < 2.3.0 - Privilege Escalation to Administrator via 'meta' Sync Actio
CVE-2026-124652		Mine CloudVod < 2.6.6 - Subscriber+ Order Information Disclosure via IDOR
CVE-2026-124653		Mine CloudVod < 2.6.6 - Unauthenticated Cloud Storage Credential Disclosure
CVE-2026-124647		TI WooCommerce Wishlist < 2.0.7 - Unauthenticated SQLi via tinv_wishlistkey Cookie
CVE-2026-124648		TI WooCommerce Wishlist < 2.13.0 - Unauthenticated Wishlist Item Deletion via Share Key
CVE-2026-124814		Ultimate Addons for Elementor Forms < 1.0.8 - Unauthenticated Arbitrary File Upload via 't
CVE-2026-124817		Clockinator Lite < 1.1.0 - Unauthenticated Leave Record Modification
CVE-2026-124665		Order Tracking < 3.6.2 - Unauthenticated Customer and Sales Rep Order History Disclosure v

IV. Related Vulnerabilities

Same product: Clockinator Lite

Same vendor: Unknown