CVE-2025-6833 is an authorization bypass vulnerability in the All in One Time Clock Lite WordPress plugin (up to version 2.0). The flaw exists in the 'aio_time_clock_lite_js' AJAX action where a user-controlled key is not properly validated, allowing authenticated users with subscriber or higher privileges to manipulate clock-in and clock-out records of other users. This is an example of an Insecure Direct Object Reference (CWE-639). The vulnerability has a CVSS score of 4.3, reflecting a medium impact primarily on integrity without affecting confidentiality or availability.

An attacker with subscriber-level access or higher can alter time clock records of other users, potentially affecting data integrity related to employee time tracking. There is no impact on confidentiality or availability reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict plugin usage to trusted users only and monitor for suspicious activity related to time clock entries. Avoid granting subscriber or higher privileges to untrusted users.