CVE-2025-9018 is a missing authorization vulnerability (CWE-862) in the germanpearls Time Tracker WordPress plugin versions up to 3.1.0. The issue arises because the functions 'tt_update_table_function' and 'tt_delete_record_function' do not perform proper capability checks. As a result, authenticated users with low privileges (Subscriber-level and above) can update plugin options such as user registration and default role, allowing arbitrary users to gain Administrator privileges. They can also delete limited data from the database. This vulnerability affects all versions up to and including 3.1.0 and has a CVSS 3.1 base score of 8.8, reflecting high impact and ease of exploitation over the network without user interaction.

An attacker with Subscriber-level access or higher can exploit this vulnerability to escalate privileges by modifying user registration settings and default roles, effectively allowing any user to register as an Administrator. This compromises the confidentiality and integrity of the WordPress site and its data. Additionally, the attacker can delete certain data from the database, impacting availability. The vulnerability affects all versions up to 3.1.0 of the Time Tracker plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a fix is available, restrict plugin usage to trusted users only and consider disabling or removing the Time Tracker plugin if Subscriber-level users cannot be fully trusted. Monitor vendor channels for updates and apply official patches promptly once released.