WP Time Capsule CVE-2026-107237

The target must be running Backup and Staging by WP Time Capsule before 1.22.28 and must be using the plugin's staging-to-live deployment feature, with a staging site linked to a separate live site. The attacker needs only an authenticated low-privilege account (Subscriber) on the WP Time Capsule staging site; the deploy handler enforces no capability or nonce check, so no admin rights are required. Limiting factors that reduce real-world risk: exploitation depends on this specific non-default staging/deploy configuration being in use (reflected in the CVSS AC:H), the attacker must first obtain a registered account on the staging instance (PR:L, not fully unauthenticated), and only versions before 1.22.28 are affected.

This is a genuine but conditional priority rather than a drop-everything emergency. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H, base 8.2 High) indicates a network-reachable flaw requiring only low privileges (PR:L - a Subscriber account) and no user interaction, with a scope change (S:C) reflecting that the vulnerable staging component impacts a separate live site, causing high integrity and availability damage but no confidentiality loss (C:N) - consistent with CWE-862 Missing Authorization and the description of database/config overwrite. The AC:H rating is meaningful: exploitation is not fully trivial because it depends on the victim running the plugin's staging-to-live deployment workflow and the attacker holding an account on the staging instance. Publicly available exploit code exists (reported by WPScan), which raises practical risk, but this must not be conflated with active exploitation. The vulnerability is NOT in CISA KEV, so there is no confirmed in-the-wild exploitation. EPSS is not provided in the input, so probabilistic exploitation likelihood cannot be assessed here - STATE EXPLICITLY: no EPSS score available. No SSVC decision data was supplied. Net: credible, patchable, exploit-code-available integrity/availability threat gated by the AC:H preconditions, warranting prompt patching for sites using the staging feature, but without evidence of mass exploitation.

An attacker registers or acquires a low-privilege Subscriber account on a WP Time Capsule staging site, then directly calls the staging-to-live deployment handler, which performs no capability or nonce check. Because public exploit code exists (WPScan), the request can be crafted to push the staging database and configuration over the separate production site, corrupting it and taking it offline. The AC:H rating reflects that this requires the target to actually use the staging/live deployment feature and the attacker to hold a staging-site account.