Backup And Staging By Wp Time Capsule
Approved changes feed: RSS · Atom
cpe:2.3:a:revmakx:backup_and_staging_by_wp_time_capsule:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Revmakx (ec04725c-9c46-5125-b426-dfc1080ff232) |
|---|---|
| Product | Backup And Staging By Wp Time Capsule (df544189-12b9-52b0-a271-b72d9a0a0829) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/wpplugins/wp-time-capsule |
purl2cpe | 2026-06-01 10:15:34.470496 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-8996 |
vulnerable | 2026-07-29 01:09:06.558115 |
Backup and Staging by WP Time Capsule <= 1.22.26 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via download_recent_decrypted_file_wptc Function
MEDIUM (6.5)
The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.22.26 via the download_recent_decrypted_file_wptc. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract download the most recently admin-decrypted SQL database backup, which typically contains password hashes, user credentials, and other sensitive site configuration data stored in the 'recent_decrypted_file' option. Exploitation requires that an administrator has previously performed a decrypt action, causing the decrypted SQL backup file to exist in the plugin's upload directory; without this prior admin action, there is no file to serve.
Published: 2026-07-09T06:52:51.697Z
Updated: 2026-07-09T17:29:08.760Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-42760 |
vulnerable | 2026-06-08 08:03:16.661570 |
WordPress Backup and Staging by WP Time Capsule plugin <= 1.22.25 - Broken Authentication vulnerability
HIGH (7.5)
Authentication Bypass Using an Alternate Path or Channel vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows Password Recovery Exploitation.This issue affects Backup and Staging by WP Time Capsule: from n/a through <= 1.22.25.
Published: 2026-05-27T09:49:05.897Z
Updated: 2026-05-27T10:47:45.332Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-47477 |
vulnerable | 2026-06-08 07:27:14.442041 |
WordPress Backup and Staging by WP Time Capsule plugin <= 1.22.23 - Reflected Cross Site Scripting (XSS) vulnerability
HIGH (7.1)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows Reflected XSS.This issue affects Backup and Staging by WP Time Capsule: from n/a through <= 1.22.23.
Published: 2025-06-09T15:54:12.253Z
Updated: 2026-04-28T16:12:42.304Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-8856 |
vulnerable | 2026-06-08 07:00:25.846095 |
Backup and Staging by WP Time Capsule <= 1.22.21 - Unauthenticated Arbitrary File Upload
CRITICAL (9.8)
The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the the UploadHandler.php file and no direct file access prevention in all versions up to, and including, 1.22.21. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Published: 2024-11-16T04:29:15.950Z
Updated: 2026-04-08T17:35:01.041Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-49684 |
vulnerable | 2026-06-08 06:50:14.512294 |
WordPress Backup and Staging by WP Time Capsule plugin <= 1.22.21 - PHP Object Injection vulnerability
HIGH (7.2)
Deserialization of Untrusted Data vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows Object Injection.This issue affects Backup and Staging by WP Time Capsule: from n/a through <= 1.22.21.
Published: 2024-10-23T15:13:55.505Z
Updated: 2026-04-28T16:10:27.453Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-48020 |
vulnerable | 2026-06-08 06:48:13.540298 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-38770 |
vulnerable | 2026-06-08 06:41:48.077674 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.