High severity8.3NVD Advisory· Published Oct 18, 2024· Updated Jun 17, 2026

CVE-2024-9593

Description

The Time Clock plugin and Time Clock Pro plugin for WordPress are vulnerable to Remote Code Execution in versions up to, and including, 1.2.2 (for Time Clock) and 1.1.4 (for Time Clock Pro) via the 'etimeclockwp_load_function_callback' function. This allows unauthenticated attackers to execute code on the server. The invoked function's parameters cannot be specified.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Time Clock Prollm-create
Range: <=1.1.4
WordPress/Time Clockllm-fuzzy
Range: <=1.2.2
Package: https://wordpress.org/plugins/time-clock
scottpaterson/Time Clock – A WordPress Employee & Volunteer Time Clock Pluginv5
Range: 0
Scott Paterson/Time Clock Prov5
Range: 0

Patches

Vulnerability mechanics

References

www.wordfence.com/threat-intel/vulnerabilities/id/247e599a-74e2-41d5-a1ba-978a807e6544nvdThird Party Advisory
plugins.trac.wordpress.org/browser/time-clock/tags/1.2.2/includes/admin/ajax_functions_admin.phpnvdProduct
plugins.trac.wordpress.org/changeset/3171046/time-clocknvdProduct

News mentions

No linked articles in our index yet.

cvss	0.540
epss	0.010
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000