What is CVE-2024-9593?

CVE-2024-9593 is a high-severity vulnerability in Scott Paterson Time Clock Pro, classified under Code Injection. CVSS score: 8.3/10. Published 2024-10-18.

How severe is CVE-2024-9593?

High severity. CVSS v3 base score is 8.3 out of 10.

Is CVE-2024-9593 known to be exploited?

7 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Scott Paterson Time Clock Pro

CVE-2024-9593

The Time Clock plugin and Time Clock Pro plugin for WordPress are vulnerable to Remote Code Execution in versions up to, and including, 1.2.2 (for Time Clock) and 1.1.4 (for Time Clock Pro) via the 'etimeclockwp_load_function_callback' function. This allows unauthenticated attackers to execute code on the server. The invoked function's parameters cannot be specified.

Vulnerability class: RCE (Remote Code Execution)

Published 2024-10-18 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 8.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L.

EPSS exploit prediction

EPSS: 0.124 (96.1th percentile), scored 2026-09-30.

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 96th percentile — 96.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.123 · newest: 0.124 · change: +0.001

Affected products

Scott Paterson Time Clock Pro — versions 0
Scottpaterson Time Clock – A WordPress Employee & Volunteer Plugin — versions 0
Wpplugin Time Clock

Weakness classification (CWE)

CWE-94 — Code Injection

Public proof-of-concept exploits

References

www.wordfence.com/threat-intel/vulnerabilities/id/247e599a-74e2-41d5-a1ba-978a8… (Third Party Advisory)
plugins.trac.wordpress.org/browser/time-clock/tags/1.2.2/includes/admin/ajax_fu… (Product)
plugins.trac.wordpress.org/changeset/3171046/time-clock (Product)

Frequently asked questions

What is CVE-2024-9593?: CVE-2024-9593 is a high-severity vulnerability in Scott Paterson Time Clock Pro, classified under Code Injection. CVSS score: 8.3/10. Published 2024-10-18.
How severe is CVE-2024-9593?: High severity. CVSS v3 base score is 8.3 out of 10.
Is CVE-2024-9593 known to be exploited?: 7 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.