What is the CVSS score of EUVD-2026-32208?

EUVD-2026-32208 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of WP Time Capsule are affected by EUVD-2026-32208?

The WordPress 'Backup and Staging by WP Time Capsule' plugin (through version 1.22.25) contains an authentication bypass vulnerability (CVE-2026-42760) enabling remote, unauthenticated attackers to…

How to fix or mitigate EUVD-2026-32208?

Within 24 hours: Audit all WordPress installations for 'Backup and Staging by WP Time Capsule' plugin presence and version; disable the plugin if not mission-critical. Within 7 days: Implement IP-based access restrictions on the plugin's password-recovery endpoint if continued operation is required; enable monitoring and alerting for suspicious account recovery attempts in access logs. Within 30 days: Monitor Patchstack advisories and vendor announcements for patch availability; evaluate and prepare migration to alternative backup/staging solution.

WP Time Capsule EUVD-2026-32208

| CVE-2026-42760 HIGH

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-05-27 audit@patchstack.com

GHSA-89j6-x8jj-2j36

WordPress Authentication Bypass Wordpress Plugin

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 20:34 vuln.today

DescriptionCVE.org

Authentication Bypass Using an Alternate Path or Channel vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows Password Recovery Exploitation.This issue affects Backup and Staging by WP Time Capsule: from n/a through <= 1.22.25.

AnalysisAI

Authentication bypass in the WordPress plugin 'Backup and Staging by WP Time Capsule' (all versions through 1.22.25) lets remote, unauthenticated attackers abuse an alternate password-recovery channel to gain unauthorized account access without valid credentials. The flaw, reported by Patchstack and tracked as EUVD-2026-32208, carries a CVSS 7.5 (confidentiality-only impact) but currently has no public exploit identified at time of analysis and a very low EPSS exploitation probability of 0.04% (13th percentile). Successful exploitation exposes sensitive access to the affected site, and the plugin's backup/staging role makes any resulting account takeover especially damaging.

Technical ContextAI

The affected component is the 'Backup and Staging by WP Time Capsule' WordPress plugin (slug wp-time-capsule) by revmakx, which manages site backups and staging environments. The root cause is CWE-288 (Authentication Bypass Using an Alternate Path or Channel): the plugin exposes a secondary code path - described here as 'Password Recovery Exploitation' - that performs identity verification incorrectly, allowing it to be reached or satisfied without traversing the primary, properly-guarded login flow. No CPE string was supplied in the provided data, so exact platform tuples cannot be enumerated beyond the EUVD-listed range. Because the plugin handles backups (which can contain database dumps and credentials), an authentication bypass against it carries outsized confidentiality consequences, consistent with the CVSS vector showing C:H but I:N/A:N.

RemediationAI

No vendor-released patch version was identified in the provided data; the affected range ('<= 1.22.25') implies a fixed release above 1.22.25 may exist, but no fixed version is confirmed here, so administrators should consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/wp-time-capsule/vulnerability/wordpress-backup-and-staging-by-wp-time-capsule-plugin-1-22-25-broken-authentication-vulnerability) for an updated version and upgrade as soon as one is published. Until then, the highest-assurance compensating control is to deactivate and remove the plugin (trade-off: loss of automated backup/staging functionality, so ensure an alternate backup mechanism is in place). Where the plugin must remain active, restrict network access to its password-recovery and AJAX/REST endpoints via web-server rules or IP allowlisting to admin networks (trade-off: legitimate remote recovery flows break and require coordination), and enable a WAF with Patchstack's virtual-patch ruleset for this CVE (trade-off: virtual patching mitigates but does not eliminate the underlying flaw). Avoid storing reusable credentials in backups reachable through the plugin to limit blast radius.