The Time Tracker WordPress plugin is affected by a missing capability check in its update and delete functions. Users with Subscriber-level access or higher can modify core options such as user registration settings and the default role assigned to new users. This flaw allows an attacker to create users with Administrator privileges and to delete selected records from the database, compromising data integrity and elevating privileges.

All installations of the germanpearls Time Tracker plugin up to and including version 3.1.0 are affected. The vulnerability impacts the WordPress plugin regardless of the hosting environment, as long as the plugin is active and the user is authenticated with Subscriber or higher capabilities.

The CVSS score of 8.8 indicates a high severity, while the EPSS score of less than 1% suggests that exploit attempts are currently rare. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack requires the attacker to be authenticated and have Subscriber-level access or higher; authorized users can exploit the flaw by invoking the exposed functions without additional prerequisites. The lack of a capability check in the plugin code allows direct privilege escalation and data tampering.