EUVD-2026-32208
GHSA-89j6-x8jj-2j36
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
1DescriptionNVD
Authentication Bypass Using an Alternate Path or Channel vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows Password Recovery Exploitation.This issue affects Backup and Staging by WP Time Capsule: from n/a through <= 1.22.25.
AnalysisAI
Authentication bypass in the WordPress plugin 'Backup and Staging by WP Time Capsule' (all versions through 1.22.25) lets remote, unauthenticated attackers abuse an alternate password-recovery channel to gain unauthorized account access without valid credentials. The flaw, reported by Patchstack and tracked as EUVD-2026-32208, carries a CVSS 7.5 (confidentiality-only impact) but currently has no public exploit identified at time of analysis and a very low EPSS exploitation probability of 0.04% (13th percentile). …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Audit all WordPress installations for 'Backup and Staging by WP Time Capsule' plugin presence and version; disable the plugin if not mission-critical. Within 7 days: Implement IP-based access restrictions on the plugin's password-recovery endpoint if continued operation is required; enable monitoring and alerting for suspicious account recovery attempts in access logs. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today