What the vulnerability does
01Description
The Time Tracker plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'tt_update_table_function' and 'tt_delete_record_function' functions in all versions up to, and including, 3.1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update options such as user registration and default role, allowing anyone to register as an Administrator, and to delete limited data from the database.
Explanation of Vulnerability in Simple Terms
02Summary
Time Tracker versions 3.1.0 and earlier lack proper authorization checks, allowing authenticated users to access or modify data they should not have permission to view or change. An attacker with a low-privilege account can read sensitive information and alter records across the application. No user interaction is required beyond initial login.
What an attacker can do
03Attacker Capabilities
Read and modify any data in Time Tracker without proper permission checks.
Potential impact on your site
04Site Impact
Any authenticated user can access confidential records and alter time tracking data, compromising data integrity and privacy.
Conditions required to exploit
05Prerequisites
Attacker must have a valid low-privilege user account on the Time Tracker instance.
Key dates
06Disclosure timeline
September 11, 2025
CVE published
April 8, 2026
Record updated
