CVE-2026-124815
CRITICAL
NVD
CVSS Score
10
Severity
CRITICAL
Published
Nov 12, 2026
Vendor
unknown
Description
The Clockinator Lite WordPress plugin before 1.1.0 does not restrict access to several of its record deletion actions, and uses a user-supplied table name in a SQL query without validating or escaping it, allowing unauthenticated users to perform SQL injection attacks, deleting data from any database table and extracting sensitive information such as password hashes.