PT-2025-44939 · WordPress · All In One Time Clock Lite

Athiwat Tiprasaharn · Published 2025-11-04 · Updated 2025-11-04 · CVE-2025-11758

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions All in One Time Clock Lite versions up to and including 2.0.3

Description The plugin exhibits unauthorized access due to a missing authorization check. Admin-level AJAX actions are exposed to unauthenticated users through wp ajax nopriv hooks, relying solely on a nonce check without capability checks. This allows attackers to create published pages, create shift records with integrity issues, and download time reports containing PII, such as employee names and work schedules.

Recommendations Update to a version beyond 2.0.3.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-11758

Affected Products

All In One Time Clock Lite

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-11758 · Security Note
• https://t.me/cveNotify/141503 · Telegram Post
• https://plugins.trac.wordpress.org/browser/aio-time-clock-lite/tags/2.0.1/aio-time-clock-lite-actions.php#L1447 · Note
• https://plugins.trac.wordpress.org/browser/aio-time-clock-lite/tags/2.0.1/aio-time-clock-lite-actions.php#L26 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/28246279-ecd8-4731-a4cc-64a3a4167323?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3388144 · Note
• https://plugins.trac.wordpress.org/browser/aio-time-clock-lite/tags/2.0.1/aio-time-clock-lite-actions.php#L442 · Note