CVE-2024-9593

HIGH EXPLOITED NUCLEI

Wpplugin Time Clock < 1.1.4 - Code Injection

Title source: rule

Description

The Time Clock plugin and Time Clock Pro plugin for WordPress are vulnerable to Remote Code Execution in versions up to, and including, 1.2.2 (for Time Clock) and 1.1.4 (for Time Clock Pro) via the 'etimeclockwp_load_function_callback' function. This allows unauthenticated attackers to execute code on the server. The invoked function's parameters cannot be specified.

Exploits (4)

nomisec WORKING POC 7 stars
by RandomRobbieBF · remote
https://github.com/RandomRobbieBF/CVE-2024-9593
nomisec SCANNER 2 stars
by 0x4f5da2-venom · remote
https://github.com/0x4f5da2-venom/CVE-2024-9593-EXP
nomisec WORKING POC 1 stars
by Nxploited · remote
https://github.com/Nxploited/CVE-2024-9593-Exploit
github WORKING POC
by Boshe99 · pythonpoc
https://github.com/Boshe99/CVE-Exploits/tree/main/CVE-2024-9593-Exploit

Nuclei Templates (1)

Time Clock <= 1.2.2 & Time Clock Pro <= 1.1.4 - Remote Code Execution
HIGHVERIFIEDby s4e-io
FOFA: body="/wp-content/plugins/time-clock/" || body="/wp-content/plugins/time-clock-pro/"

Scores

CVSS v3 8.3
EPSS 0.8171
EPSS Percentile 99.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Exploitation Intel

VulnCheck KEV 2025-03-11

Classification

CWE
CWE-94
Status published

Affected Products (2)

wpplugin/time_clock < 1.1.4
wpplugin/time_clock < 1.2.2

Timeline

Published Oct 18, 2024
Tracked Since Feb 18, 2026