Executive Summary

The vulnerability in the All in One Time Clock Lite WordPress plugin allows unauthorized users to access admin-level AJAX actions without proper authorization checks. This happens because the plugin exposes these actions to unauthenticated users via wp_ajax_nopriv_ hooks and only uses a nonce check without verifying user capabilities. As a result, attackers can perform actions such as creating published pages, creating shift records with integrity issues, and downloading time reports containing personally identifiable information (PII).

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing unauthenticated attackers to manipulate your WordPress site through the All in One Time Clock Lite plugin. They can create published pages without permission, generate inaccurate or tampered shift records, and access sensitive time reports that include employee names and work schedules. This can lead to data integrity issues and exposure of confidential employee information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can negatively affect compliance with standards like GDPR and HIPAA because it allows unauthorized access to personally identifiable information (PII) such as employee names and work schedules. Exposure of such sensitive data without proper authorization can lead to violations of data protection and privacy regulations.

Useful 0 Not Useful 0