{"affected":[{"defaultStatus":"unaffected","product":"Clockinator Lite","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"1.1.0","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-124815","cwes":["CWE-89"],"description":"The Clockinator Lite WordPress plugin before 1.1.0 does not restrict access to several of its record deletion actions, and uses a user-supplied table name in a SQL query without validating or escaping it, allowing unauthenticated users to perform SQL injection attacks, deleting data from any database table and extracting sensitive information such as password hashes.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/a7fe2ca1-ddfe-45fa-93e2-e0959ae29256/"}],"kev":null,"metrics":[],"modifiedAt":1794463209952,"publishedAt":1794463209952,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/a7fe2ca1-ddfe-45fa-93e2-e0959ae29256/"}],"remediation":[],"revision":"11ff4e605e1a9e08f958c5f3cc1e44fba79daff0bf35e2cc7dc0fdb52b2bea58","sources":[{"modifiedAt":1794463209952,"name":"CNA: WPScan","retrievedAt":1794467329687,"url":"https://www.cve.org/CVERecord?id=CVE-2026-124815"}],"ssvc":null,"status":"published","title":"Clockinator Lite < 1.1.0 - Unauthenticated SQLi via Record Deletion Actions","updatedAt":1794467329687}