UNKNOWNCVSS not yet scoredVulnerability
CVE-2026-124815
The Clockinator Lite WordPress plugin before 1.1.0 does not restrict access to several of its record deletion actions, and uses a user-supplied table name in a SQL query without validating or escaping it, allowing unauthenticated users to perform SQL injection attacks, deleting data from any database table and extracting sensitive information such as password hashes.
Properties
- Last source
- NVD
- Nvd fetched at
- 2026-11-12T07:51:00.177133+00:00
- Cve id
- CVE-2026-124815
- First seen by Signal
- 2026-11-12T07:52:20+00:00
- Retrieved at
- 2026-11-12T07:52:20+00:00
- Published at
- 2026-11-12T06:17:13.853
- Last modified
- 2026-11-12T06:17:13.853
Explore deeper with Ninja Signal's threat intelligence graph