CVE-2024-9593: The Time Clock plugin and Time Clock Pro plugin for WordPress are vulnerable to Remote Code Execution in versions up to, and including, 1.2.2 (for Time Clock)…

PriorityP184high8.3CVSS 3.1

AVNACLPRNUINSCCLILAL

ITWEXPLOITVulnCheck KEVInitial access

Exploited in the wild

EPSS

12.49%

95.7th percentile

The Time Clock plugin and Time Clock Pro plugin for WordPress are vulnerable to Remote Code Execution in versions up to, and including, 1.2.2 (for Time Clock) and 1.1.4 (for Time Clock Pro) via the 'etimeclockwp_load_function_callback' function. This allows unauthenticated attackers to execute code on the server. The invoked function's parameters cannot be specified.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
scott_paterson	time_clock_pro	<= 1.1.4	—
scottpaterson	time_clock_a_wordpress_employee_volunteer_time_clock_plugin	<= 1.2.2	—
wpplugin	time_clock	<= 1.1.4	—
wpplugin	time_clock	<= 1.2.2	—

Detection & IOCsextracted from sources · hover to see the quote

yara

Time Clock PHP Version ([0-9.]+)

→Target the unauthenticated RCE entry point: monitor HTTP requests invoking 'etimeclockwp_load_function_callback' in the Time Clock / Time Clock Pro WordPress plugins (versions up to 1.2.2 and 1.1.4 respectively) for unexpected or malicious function calls. ↗

·The invoked function's parameters cannot be specified by the attacker, which limits but does not eliminate exploitation potential — detection should still flag any unauthenticated invocation of the callback. ↗
·The YARA/signature fragment includes a digest line that may represent a rule signature or integrity check; treat it as part of the detection artifact context.

CVSS provenance

nvdv3.18.3HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

vulncheck8.3HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.