CVE-2026-124817

The Clockinator Lite WordPress plugin versions prior to 1.1.0 contains a vulnerability where it fails to verify authorization or ownership during leave request updates. This flaw allows unauthenticated users to modify any leave record, which includes the ability to approve, reject, or reassign re...