What is CVE-2024-9593?

CVE-2024-9593 is a high-severity vulnerability in Scott Paterson Time Clock Pro, classified under Code Injection. CVSS score: 8.3/10. Published 2024-10-18.

How severe is CVE-2024-9593?

High severity. CVSS v3 base score is 8.3 out of 10.

Is CVE-2024-9593 known to be exploited?

7 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Scott Paterson Time Clock Pro

CVE-2024-9593

The Time Clock plugin and Time Clock Pro plugin for WordPress are vulnerable to Remote Code Execution in versions up to, and including, 1.2.2 (for Time Clock) and 1.1.4 (for Time Clock Pro) via the 'etimeclockwp_load_function_callback' function. This allows unauthenticated attackers to execute code on the server. The invoked function's parameters cannot be specified.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.123 (95.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L.

Affected products

Scott Paterson Time Clock Pro — versions 0
Scottpaterson Time Clock – A Wordpress Employee & Volunteer Plugin — versions 0
Wpplugin Time_clock

Weakness classification (CWE)

CWE-94 — Code Injection

Public proof-of-concept exploits

References

security@wordfence.com (Third Party Advisory)
security@wordfence.com (Product)
security@wordfence.com (Product)

Frequently asked questions

What is CVE-2024-9593?: CVE-2024-9593 is a high-severity vulnerability in Scott Paterson Time Clock Pro, classified under Code Injection. CVSS score: 8.3/10. Published 2024-10-18.
How severe is CVE-2024-9593?: High severity. CVSS v3 base score is 8.3 out of 10.
Is CVE-2024-9593 known to be exploited?: 7 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.