CVE-2024-9593
Improper Control of Generation of Code ('Code Injection') (CWE-94)
Summary
The Time Clock plugin and Time Clock Pro plugin for WordPress are vulnerable to Remote Code Execution in versions up to, and including, 1.2.2 (for Time Clock) and 1.1.4 (for Time Clock Pro) via the 'etimeclockwp_load_function_callback' function. This allows unauthenticated attackers to execute code on the server. The invoked function's parameters cannot be specified.
Impact
This vulnerability allows unauthenticated attackers to execute arbitrary code on the server, potentially leading to complete compromise of the affected WordPress installation. The impact is severe as it can result in unauthorized access, data theft, website defacement, or use of the server for further malicious activities. The CVSS v3.1 base score of 8.3 (High severity) indicates a significant risk, with the attack vector being network-based, requiring no user interaction, and having a low attack complexity.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
Patches are available. Users of the Time Clock plugin should update to a version newer than 1.2.2, and users of the Time Clock Pro plugin should update to a version newer than 1.1.4.
Mitigation
1. Immediately update the affected plugins to the latest versions that address this vulnerability. 2. If immediate updating is not possible, consider temporarily disabling the affected plugins until they can be updated. 3. Implement strong Web Application Firewall (WAF) rules to filter out potentially malicious requests targeting the 'etimeclockwp_load_function_callback' function. 4. Regularly monitor WordPress and plugin versions, and implement a robust patch management process to ensure timely updates. 5. Conduct a thorough security audit of the WordPress installation to identify and address any potential compromises that may have occurred prior to patching.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Timeline
Feedly found the first article mentioning CVE-2024-9593. See article
Feedly estimated the CVSS score as HIGH
NVD published the first details for CVE-2024-9593
A CVSS base score of 8.3 has been assigned.
CVE-2024-9593 is a critical vulnerability in the Time Clock and Time Clock Pro plugins for WordPress, with a CVSS score of 8.3, allowing unauthenticated attackers to execute arbitrary code on the server. Currently, there is no evidence of exploitation in the wild or public proof-of-concept exploits; however, patches are available, and users are advised to update to versions newer than 1.2.2 and 1.1.4, respectively. Mitigations include temporarily disabling the affected plugins and implementing strong Web Application Firewall rules to filter malicious requests. See article
EPSS Score was set to: 0.05% (Percentile: 21.5%)