What is the CVSS score of CVE-2026-8996?

CVE-2026-8996 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

WP Time Capsule CVE-2026-8996

EUVD-2026-42527 MEDIUM

Missing Authorization (CWE-862)

2026-07-09 Wordfence

GHSA-cxpp-m57j-hhq8

WordPress Authentication Bypass Information Disclosure Wordpress Plugin Backup And Staging By Wp Time Capsule Revmakx

6.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.3 MEDIUM

AC:H reflects that exploitation requires a prior admin decrypt action beyond the attacker's control; PR:L confirmed by subscriber-level requirement; no integrity or availability impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 08:49 vuln.today

CVE Published

Jul 09, 2026 - 06:52 nvd

MEDIUM 6.5

DescriptionCVE.org

The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.22.26 via the download_recent_decrypted_file_wptc. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract download the most recently admin-decrypted SQL database backup, which typically contains password hashes, user credentials, and other sensitive site configuration data stored in the 'recent_decrypted_file' option. Exploitation requires that an administrator has previously performed a decrypt action, causing the decrypted SQL backup file to exist in the plugin's upload directory; without this prior admin action, there is no file to serve.

AnalysisAI

Sensitive information exposure in the Backup and Staging by WP Time Capsule WordPress plugin (all versions through 1.22.26) allows authenticated attackers with subscriber-level access to download a previously admin-decrypted SQL database backup via the unprotected download_recent_decrypted_file_wptc endpoint. The downloaded backup typically contains WordPress password hashes, user credentials, and site configuration data stored in the recent_decrypted_file plugin option. No public exploit code exists at time of analysis, but the vulnerability is conditionally exploitable wherever subscriber-level user registration is enabled and an administrator has recently used the plugin's decrypt function.

Technical ContextAI

The vulnerability resides in the Backup and Staging by WP Time Capsule plugin (CPE: cpe:2.3:a:revmakx:backup_and_staging_by_wp_time_capsule:*) developed by Revmakx, affecting all releases through 1.22.26. CWE-862 (Missing Authorization) is the root cause: the download_recent_decrypted_file_wptc handler, visible in wp-time-capsule.php at lines 410 and 3764 and rendered by Views/wptc-download-file.php at line 23, fails to enforce that only administrative roles may initiate a download of the decrypted backup. When an administrator previously uses the plugin's decrypt feature, the resulting plaintext SQL file is persisted to the plugin's upload directory and its path is written to the recent_decrypted_file WordPress option. A subscriber-level user can then call the insufficiently guarded download endpoint and retrieve the complete decrypted SQL dump without authorization.

RemediationAI

A patch commit is referenced via the WordPress.org SVN changeset 3563585 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3563585%40wp-time-capsule&new=3563585%40wp-time-capsule); however, the exact version number of the released patched build is not independently confirmed from available data - update to the latest available version in the WordPress plugin repository and verify the installed version exceeds 1.22.26 before considering the issue resolved. As an interim compensating control, site administrators should disable open user registration (Settings > General > uncheck 'Anyone can register') to eliminate the subscriber-level attack surface; note this affects legitimate community functions. Additionally, avoid triggering the plugin's decrypt feature on production sites unless immediately necessary, as the decrypted SQL file persists in the upload directory until cleared. If the decrypt action has already been performed, manually locate and delete the cached SQL file from the plugin's upload directory to eliminate the artifact that would be served. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/f7c39d66-f1e1-4d41-a9e4-984aec3f37dc should be monitored for confirmed fixed version details.