CVE-2025-11758 is a missing authorization vulnerability (CWE-862) in the All in One Time Clock Lite WordPress plugin by codebangers. The plugin exposes admin-level AJAX actions to unauthenticated users via wp_ajax_nopriv_ hooks, relying only on nonce validation without verifying user capabilities. This flaw enables unauthenticated attackers to perform privileged actions including creating published pages, creating shift records with integrity issues, and downloading sensitive time reports containing employee PII. The vulnerability affects all versions up to and including 2.0.3. No patch or official fix is currently documented.

Exploitation of this vulnerability allows unauthenticated attackers to gain unauthorized access to administrative functions of the plugin. This leads to potential data integrity issues by creating unauthorized shift records, unauthorized content creation by publishing pages, and disclosure of sensitive employee information such as names and work schedules. The confidentiality and integrity of employee time tracking data are compromised. There is no indication of availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the plugin or restricting access to AJAX endpoints via web application firewall rules or other access controls to prevent unauthenticated access. Monitor vendor channels for updates and apply patches promptly once available.