The All in One Time Clock Lite WordPress plugin is vulnerable because the AJAX action 'aio_time_clock_lite_js' accepts a user‑controlled key without verifying that the caller owns the referenced clock record. The bug is an insecure direct object reference, classified as CWE‑639. Attackers who are logged in with a subscriber role or higher can submit arbitrary key values to cause the plugin to record in‑time or out‑time events on behalf of any other user. This lets an attacker create, modify or erase time entries, which can distort payroll calculations, time‑off tracking and compliance reporting.

All versions of the plugin up to and including 2.0 are affected. The product vendor is Codebangers, and the affected application is the "All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier" WordPress plugin. No specific sub‑version details are given beyond the general cutoff at 2.0.

The CVSS score of 4.3 labels the vulnerability as moderate. The EPSS score is reported as less than 1 %, indicating a very low chance of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack path requires an authenticated user with subscriber or higher permissions; the attacker simply crafts an AJAX request to 'aio_time_clock_lite_js' with a forged key to influence another user's clock‑in/out status. Because the problem stems from missing authorization checks, no network‑level or remote code execution is required.