Unauthorized Data Modifications in Time Tracker Plugin for WordPress

CVE-2025-9018

What is CVE-2025-9018?

The Time Tracker plugin for WordPress contains vulnerabilities due to inadequate capability checks on functions that allow authenticated users to modify important settings. Attackers with Subscriber-level access and higher can exploit this flaw, leading to unauthorized changes such as user registrations as Administrators and the ability to delete specific data from the database, which could severely compromise the security and integrity of the WordPress site.

References