Clockinator Lite < 1.1.0 - Unauthenticated SQLi via Record Deletion Actions

Description

The plugin does not restrict access to several of its record deletion actions, and uses a user-supplied table name in a SQL query without validating or escaping it, allowing unauthenticated users to perform SQL injection attacks, deleting data from any database table and extracting sensitive information such as password hashes.