CVE-2024-9593highobserved exploitationCWE-94

CVE-2024-9593: high-severity vulnerability in Scott Paterson Time Clock Pro

Time Clock <= 1.2.2 & Time Clock Pro <= 1.1.4 - Unauthenticated (Limited) Remote Code Execution

Published · Updated

Follow this CVE+ Monitor Time Clock – A WordPress Employee & Volunteer Time Clock Plugin+ Monitor Time Clock Pro

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

83Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 8.3epss 12%
from disclosure to weaponsame day
Published on NVDOct 18
1st PoCOct 18
VulnCheck+144d
The Time Clock plugin and Time Clock Pro plugin for WordPress are vulnerable to Remote Code Execution in versions up to, and including, 1.2.2 (for Time Clock) and 1.1.4 (for Time Clock Pro) via the 'etimeclockwp_load_function_callback' function. This allows unauthenticated attackers to execute code on the server. The invoked function's parameters cannot be specified.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Affected products
scottpaterson · Time Clock – A WordPress Employee & Volunteer Time Clock PluginScott Paterson · Time Clock Pro
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Scott Paterson Time Clock Pro

In the same product, most dangerous first.

CVE-2025-10701MEDIUMTime Clock – A WordPress Employee & Volunteer Time Clock Plugin <= 1.3.1 - Authenticated (Custom+) Stored Cross-Site ScriptingEPSS 0.2%