Missing authorization in revmakx Backup and Staging by WP Time Capsule
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.22.26 via the download_recent_decrypted_file_wptc. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract download the most recently admin-decrypted SQL database backup, which typically contains password hashes, user credentials, and other sensitive site configuration data stored in the 'recent_decrypted_file' option. Exploitation requires that an administrator has previously performed a decrypt action, causing the decrypted SQL backup file to exist in the plugin's upload directory; without this prior admin action, there is no file to serve.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-8996
- 2026-10-03 Alias added: GHSA-cxpp-m57j-hhq8
References
Other 8
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f7c39d66-f1e1-4d41-a9e4-984aec3f37dc?source=cve
- https://plugins.trac.wordpress.org/browser/wp-time-capsule/trunk/wp-time-capsule.php#L3764
- https://plugins.trac.wordpress.org/browser/wp-time-capsule/trunk/wp-time-capsule.php#L410
- https://plugins.trac.wordpress.org/browser/wp-time-capsule/trunk/Views/wptc-download-file.php#L23
- https://plugins.trac.wordpress.org/browser/wp-time-capsule/tags/1.22.26/wp-time-capsule.php#L3764
- https://plugins.trac.wordpress.org/browser/wp-time-capsule/tags/1.22.26/wp-time-capsule.php#L410
- https://plugins.trac.wordpress.org/browser/wp-time-capsule/tags/1.22.26/Views/wptc-download-file.php#L23
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3563585%40wp-time-capsule&new=3563585%40wp-time-capsule
More revmakx vulnerabilities
- TI-2024-08222 Backup and Staging by WP Time Capsule <= 1.22.21 - Unauthenticated Arbitrary File Upload CVSS 3.1CRITICAL 9.8
- TI-2020-07033 The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization… CVSS 3.1CRITICAL 9.8
- TI-2016-09124 InfiniteWP Client Plugin injection CVSS 3.1CRITICAL 9.8
- TI-2023-02734 InfiniteWP Client <= 1.11.1 - Authenticated (Subscriber+) Sensitive Information Exposure CVSS 3.1HIGH 7.5
- TI-2024-26004 Improper privilege management in revmakx Backup and Staging by WP Time Capsule CVSS 3.1CRITICAL 9.8
- TI-2026-67954 Arbitrary file upload in WordPress WP Duplicate plugin CVSS 3.1CRITICAL 9.9
Sources
- CVE-2026-8996 · CVE Program
- CVE-2026-8996 · NVD
- FIRST EPSS
- GHSA-cxpp-m57j-hhq8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences