Auth bypass in Germanpearls Time Tracker
CVE-2025-9018
The Time Tracker plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'tt_update_table_function' and 'tt_delete_record_function' functions in all versions up to, and including, 3.1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update options such as user registration and default role, allowing anyone to register as an Administrator, and to delete limited data from the database.
Vulnerability class: Broken Access Control
EPSS: 0.003 (25.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Germanpearls Time Tracker — versions 0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-9018?
- CVE-2025-9018 is a high-severity vulnerability in Germanpearls Time Tracker, classified under Missing Authorization. CVSS score: 8.8/10. Published 2025-09-11.
- How severe is CVE-2025-9018?
- High severity. CVSS v3 base score is 8.8 out of 10.