CVE-2025-11758: WordPress Time Clock Auth Bypass Flaw

CVE-2025-11758 Overview

CVE-2025-11758 affects the All in One Time Clock Lite plugin for WordPress in all versions up to and including 2.0.3. The plugin registers admin-level AJAX actions via wp_ajax_nopriv_ hooks and validates only a nonce without performing capability checks. Unauthenticated attackers can invoke these actions to publish arbitrary pages, create shift records that undermine payroll integrity, and download time reports containing personally identifiable information (PII). The flaw is categorized as Missing Authorization [CWE-862].

Critical Impact
Unauthenticated network attackers can create published WordPress pages, manipulate employee shift records, and exfiltrate reports containing employee names and work schedules.

Affected Products

All in One Time Clock Lite plugin for WordPress — versions <= 2.0.3
WordPress sites running the plugin with wp_ajax_nopriv_ handlers exposed
Environments serving employee time-tracking data through the plugin

Discovery Timeline

2025-11-04 - CVE-2025-11758 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11758

Vulnerability Analysis

The All in One Time Clock Lite plugin registers sensitive AJAX endpoints under both wp_ajax_ and wp_ajax_nopriv_ hooks. The nopriv variant is designed for unauthenticated visitors, so any handler bound to it must enforce its own authorization checks. In this plugin, handlers accept requests as long as a valid nonce is presented. Nonces in WordPress are not authentication tokens; they only defend against Cross-Site Request Forgery (CSRF) when combined with capability checks. Because nonces can be scraped from public pages, an unauthenticated attacker can obtain one and reach administrative functionality.

The exposed handlers include operations that create published pages, insert shift records into the plugin's data model, and generate time report exports. The report export returns employee names and work schedules, resulting in disclosure of PII. The shift-creation path enables integrity attacks by inserting fabricated or manipulated records that affect downstream payroll or attendance data.

Root Cause

The root cause is a Missing Authorization weakness [CWE-862]. The plugin relies exclusively on check_ajax_referer style nonce validation and does not call current_user_can() or an equivalent capability gate before executing privileged actions. Registering these handlers on wp_ajax_nopriv_ compounds the issue by intentionally opening them to unauthenticated requests.

Attack Vector

Exploitation occurs over the network with no authentication and no user interaction. An attacker retrieves a valid nonce from a public plugin surface, then issues crafted POST requests to /wp-admin/admin-ajax.php with the vulnerable action parameter. Refer to the WordPress Action Code Review and the Wordfence Vulnerability Report for the specific vulnerable handler locations.

Detection Methods for CVE-2025-11758

Indicators of Compromise

Unexpected published pages in WordPress created by the admin-ajax.php request flow rather than the block editor
Shift records in the plugin database with anomalous timestamps, unknown employee identifiers, or bursts of creation from a single source IP
Access log entries showing POST requests to /wp-admin/admin-ajax.php referencing All in One Time Clock Lite action values from unauthenticated sessions
Outbound transfers of time report files preceded by unauthenticated AJAX calls

Detection Strategies

Alert on admin-ajax.php POSTs that invoke plugin-specific actions from clients lacking a valid WordPress authentication cookie
Correlate page-creation events in WordPress with the originating request path to identify creations that did not traverse /wp-admin/post.php
Baseline normal shift-record creation rates per user and flag deviations, especially records lacking an authenticated author

Monitoring Recommendations

Ingest WordPress access logs, wp_posts changes, and plugin database tables into a central logging or SIEM pipeline for correlation
Enable file integrity monitoring on the plugin directory to detect tampering or downgrade attempts
Track exports and downloads of time-report files and alert on requests originating from external IPs

How to Mitigate CVE-2025-11758

Immediate Actions Required

Update the All in One Time Clock Lite plugin to a version above 2.0.3 that applies the fix from WordPress Changeset 3388144
If no fixed version is available in your environment, deactivate and remove the plugin until it is patched
Audit wp_posts for pages created during the exposure window and remove attacker-created content
Review shift records and time reports for tampering, and rotate any credentials or session tokens that may have been exposed alongside the PII

Patch Information

The vendor addressed the issue in the WordPress plugin changeset, which introduces proper authorization checks on the affected AJAX handlers. Administrators should install the corresponding released plugin version via the WordPress plugin updater and verify the installed version is greater than 2.0.3.

Workarounds

Restrict access to /wp-admin/admin-ajax.php for the vulnerable plugin action values using a Web Application Firewall (WAF) rule until patching completes
Remove or filter the wp_ajax_nopriv_ handler registrations via a mu-plugin that unhooks the affected actions
Limit network exposure of the WordPress admin interface to trusted IP ranges where feasible

bash

# Example WAF rule concept: block unauthenticated admin-ajax calls to the vulnerable plugin actions
# Replace <action_name> with the specific action registered by aio-time-clock-lite
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1011758,msg:'Block AIO Time Clock Lite unauth AJAX (CVE-2025-11758)'"
  SecRule ARGS:action "@rx ^(aiotcl_|aio_time_clock_).*" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"