CVE-2024-9593
HIGH EXPLOITED NUCLEIWpplugin Time Clock < 1.1.4 - Code Injection
Title source: ruleDescription
The Time Clock plugin and Time Clock Pro plugin for WordPress are vulnerable to Remote Code Execution in versions up to, and including, 1.2.2 (for Time Clock) and 1.1.4 (for Time Clock Pro) via the 'etimeclockwp_load_function_callback' function. This allows unauthenticated attackers to execute code on the server. The invoked function's parameters cannot be specified.
Exploits (4)
nomisec
WORKING POC
7 stars
by RandomRobbieBF · remote
https://github.com/RandomRobbieBF/CVE-2024-9593
nomisec
SCANNER
2 stars
by 0x4f5da2-venom · remote
https://github.com/0x4f5da2-venom/CVE-2024-9593-EXP
nomisec
WORKING POC
1 stars
by Nxploited · remote
https://github.com/Nxploited/CVE-2024-9593-Exploit
github
WORKING POC
by Boshe99 · pythonpoc
https://github.com/Boshe99/CVE-Exploits/tree/main/CVE-2024-9593-Exploit
Nuclei Templates (1)
Time Clock <= 1.2.2 & Time Clock Pro <= 1.1.4 - Remote Code Execution
HIGHVERIFIEDby s4e-io
FOFA:
body="/wp-content/plugins/time-clock/" || body="/wp-content/plugins/time-clock-pro/"
References (3)
Scores
CVSS v3
8.3
EPSS
0.8171
EPSS Percentile
99.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Exploitation Intel
VulnCheck KEV
2025-03-11
Classification
CWE
CWE-94
Status
published
Affected Products (2)
wpplugin/time_clock
< 1.1.4
wpplugin/time_clock
< 1.2.2
Timeline
Published
Oct 18, 2024
Tracked Since
Feb 18, 2026