PT-2025-43063 · WordPress · All In One Time Clock Lite

Published 2025-10-22 · Updated 2025-10-22 · CVE-2025-6833

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier plugin for WordPress versions prior to 2.1

Description The All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier plugin for WordPress is susceptible to Insecure Direct Object Reference. This flaw exists in versions up to and including 2.0 through the ‘aio time clock lite js’ AJAX action, stemming from a lack of validation on a user-controlled key. Authenticated attackers with subscriber access or higher privileges can exploit this to clock in or out other users.

Recommendations Update to version 2.1 or later.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-6833

Affected Products

All In One Time Clock Lite

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-6833 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3336943%40aio-time-clock-lite&new=3336943%40aio-time-clock-lite&sfp_email=&sfph_mail= · Note
• https://twitter.com/VulmonFeeds/status/1980957037212168524 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/c6c48173-ffe3-40f8-a2fa-cee66869e343?source=cve · Note
• https://t.me/CVEtracker/35482 · Telegram Post