CVE-2025-11758

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11758", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-14T18:48:55.613Z", "datePublished": "2025-11-04T04:27:15.403Z", "dateUpdated": "2026-04-08T16:43:03.290Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:43:03.290Z"}, "affected": [{"vendor": "codebangers", "product": "All in One Time Clock Lite \u2013 Tracking Employee Time Has Never Been Easier", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.0.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The All in One Time Clock Lite plugin for WordPress is vulnerable to unauthorized access due to a missing authorization check in all versions up to, and including, 2.0.3. This is due to the plugin exposing admin-level AJAX actions to unauthenticated users via wp_ajax_nopriv_ hooks, while relying only on a nonce check without capability checks. This makes it possible for unauthenticated attackers to create published pages, create shift records with integrity issues, and download time reports containing PII (employee names and work schedules)."}], "title": "All in One Time Clock Lite \u2013 Tracking Employee Time Has Never Been Easier <= 2.0.3 - Missing Authorization to Page Creation and Information Exposure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/28246279-ecd8-4731-a4cc-64a3a4167323?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/aio-time-clock-lite/tags/2.0.1/aio-time-clock-lite-actions.php#L26"}, {"url": "https://plugins.trac.wordpress.org/browser/aio-time-clock-lite/tags/2.0.1/aio-time-clock-lite-actions.php#L442"}, {"url": "https://plugins.trac.wordpress.org/browser/aio-time-clock-lite/tags/2.0.1/aio-time-clock-lite-actions.php#L1447"}, {"url": "https://plugins.trac.wordpress.org/changeset/3388144/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "timeline": [{"time": "2025-11-03T13:49:43.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-03T16:00:57.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-04T21:00:38.446062Z", "id": "CVE-2025-11758", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-04T21:00:48.168Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11758", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-04T21:00:38.446062Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-04T21:00:43.058Z"}}], "cna": {"title": "All in One Time Clock Lite \u2013 Tracking Employee Time Has Never Been Easier <= 2.0.3 - Missing Authorization to Page Creation and Information Exposure", "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}}], "affected": [{"vendor": "codebangers", "product": "All in One Time Clock Lite \u2013 Tracking Employee Time Has Never Been Easier", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.0.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-03T13:49:43.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-03T16:00:57.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/28246279-ecd8-4731-a4cc-64a3a4167323?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/aio-time-clock-lite/tags/2.0.1/aio-time-clock-lite-actions.php#L26"}, {"url": "https://plugins.trac.wordpress.org/browser/aio-time-clock-lite/tags/2.0.1/aio-time-clock-lite-actions.php#L442"}, {"url": "https://plugins.trac.wordpress.org/browser/aio-time-clock-lite/tags/2.0.1/aio-time-clock-lite-actions.php#L1447"}, {"url": "https://plugins.trac.wordpress.org/changeset/3388144/"}], "descriptions": [{"lang": "en", "value": "The All in One Time Clock Lite plugin for WordPress is vulnerable to unauthorized access due to a missing authorization check in all versions up to, and including, 2.0.3. This is due to the plugin exposing admin-level AJAX actions to unauthenticated users via wp_ajax_nopriv_ hooks, while relying only on a nonce check without capability checks. This makes it possible for unauthenticated attackers to create published pages, create shift records with integrity issues, and download time reports containing PII (employee names and work schedules)."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:43:03.290Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11758", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:43:03.290Z", "dateReserved": "2025-10-14T18:48:55.613Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-04T04:27:15.403Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "All in One Time Clock Lite \u2013 Tracking Employee Time Has Never Been Easier", "vendor": "codebangers", "versions": [{"lessThanOrEqual": "2.0.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The All in One Time Clock Lite plugin for WordPress is vulnerable to unauthorized access due to a missing authorization check in all versions up to, and including, 2.0.3. This is due to the plugin exposing admin-level AJAX actions to unauthenticated users via wp_ajax_nopriv_ hooks, while relying only on a nonce check without capability checks. This makes it possible for unauthenticated attackers to create published pages, create shift records with integrity issues, and download time reports containing PII (employee names and work schedules)."}, {"lang": "es", "value": "El plugin All in One Time Clock Lite para WordPress es vulnerable a acceso no autorizado debido a una falta de verificaci\u00f3n de autorizaci\u00f3n en todas las versiones hasta la 2.0.3, inclusive. Esto se debe a que el plugin expone acciones AJAX de nivel de administrador a usuarios no autenticados a trav\u00e9s de los hooks 'wp_ajax_nopriv_', bas\u00e1ndose \u00fanicamente en una verificaci\u00f3n de nonce sin verificaciones de capacidad. Esto permite a atacantes no autenticados crear p\u00e1ginas publicadas, crear registros de turnos con problemas de integridad y descargar informes de tiempo que contienen PII (nombres de empleados y horarios de trabajo)."}], "id": "CVE-2025-11758", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11758", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-04T21:00:38.446062Z", "version": "2.0.3"}}]}, "published": "2025-11-04T05:16:02.483", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/aio-time-clock-lite/tags/2.0.1/aio-time-clock-lite-actions.php#L1447"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/aio-time-clock-lite/tags/2.0.1/aio-time-clock-lite-actions.php#L26"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/aio-time-clock-lite/tags/2.0.1/aio-time-clock-lite-actions.php#L442"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3388144/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/28246279-ecd8-4731-a4cc-64a3a4167323?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-27T22:59:21.663358+00:00", "value": {"mitigation_remediation": ["Upgrade to All in One Time Clock Lite version 2.0.4 or later to eliminate the missing authorization checks.", "If upgrading is not immediately possible, block or remove the wp_ajax_nopriv_ hooks that expose the vulnerable AJAX actions so that only authenticated administrators can invoke them.", "Configure your web server or security plugin to log and alert on unexpected POST requests to /wp-admin/admin-ajax.php associated with the plugin\u2019s action names, and verify that no new pages or shift records appear without proper admin authorization."], "summary": {"action": "Immediate Patch", "impact": "Information Disclosure & Unauthorized Creation"}, "threat_synthesis": {"affected_systems": "The vulnerability affects all releases of the codebangers All in One Time Clock Lite plugin for WordPress up to and including version 2.0.3. Websites running any of these versions are vulnerable. Plugins downloaded from the WordPress Plugin Repository up to that version are at risk.", "description_and_impact": "The All in One Time Clock Lite plugin for WordPress contains a missing authorization check that allows unauthenticated users to call admin\u2011level AJAX actions via wp_ajax_nopriv_ hooks. Because the code relies only on a nonce and performs no capability verification, an attacker can create new pages, generate shift records with integrity violations, and download time reports that include personally identifiable information such as employee names and work schedules. This flaw results in both a confidentiality breach of sensitive personnel data and an integrity compromise of content managed by the site.", "risk_and_exploitability": "The CVSS score of 6.5 indicates a medium severity flaw, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA\u2019s KEV catalog. Because the attack does not require any authentication or additional privileges, an attacker can exploit the flaw from any network\u2011accessible location by sending crafted AJAX requests to /wp-admin/admin\u2011ajax.php. The impact includes unauthorized content creation and disclosure of employee personal data."}}}}, "created": "2025-11-04T16:33:32.275471+00:00", "updated": "2026-04-27T23:00:14.005644+00:00", "vendors": ["codebangers", "codebangers$PRODUCT$all_in_one_time_clock_lite", "wordpress", "wordpress$PRODUCT$wordpress"]}