Unauthenticated File Upload Vulnerability Affects WP Time Capsule Backup and Staging Plugin
CVE-2024-8856

9.8CRITICAL

Key Information:

Vendor
Wordpress
Status
Backup And Staging By WP Time Capsule
Vendor
CVE Published:
16 November 2024

Badges

👾 Exploit Exists🟡 Public PoC📰 News Worthy

Summary

The vulnerability labeled as CVE-2024-8856 affects the WP Time Capsule plugin for WordPress, allowing unauthenticated attackers to upload arbitrary files, potentially leading to remote code execution. This flaw has a severe impact, with a CVSS score of 9.8, and affects versions of the plugin up to version 1.22.21. The potential impact of exploiting this vulnerability includes data breaches, website defacement, malware distribution, and complete server takeover. To mitigate this risk, users are advised to update to version 1.22.22, restrict file upload permissions, monitor server logs, implement regular backup routines, use strong passwords and two-factor authentication, and conduct regular plugin audits. Failure to address this vulnerability promptly could lead to severe business impacts, including reputational damage, financial losses, and potential legal consequences related to data breaches.

Affected Version(s)

Backup and Staging by WP Time Capsule * <= 1.22.21

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-8856
Created by ubaii

News Articles

favicon imageOP Innovate

Vulnerability in WP Time Capsule Plugin (CVE-2024-8856) - OP INNOVATE

Critical vulnerability in WP Time Capsule plugin (CVE-2024-8856) allows unauthenticated file uploads, risking full site takeover; update to version 1.22.22 immediately to mitigate threats.

2 months ago

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wp-time-capsul...
https://plugins.trac.wordpress.org/changeset/3188325/

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 📰

    First article discovered by OP Innovate

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rein Daelman
.