Backup and Staging by WP Time Capsule: Missing authorization in staging deployment
Summary
The staging-to-live deployment handler in the Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 performs no capability or nonce checks. An authenticated user with a Subscriber account on a staging site can overwrite the database and configuration of the separate live site and take it offline. Exploitation requires a Subscriber account on a staging site linked to the live site. NVD scoring is pending; the CVE record lists CVSS 8.2 (High), while VulDB rates it 6.3 (Medium).
Affected
- Backup and Staging by WP Time Capsule versions before 1.22.28
Fixed in
- Version 1.22.28 or later
Workaround
- Unknown for unfixed versions.
- Interim measures if updating is delayed (not from a source): disable open registration, review Subscriber accounts on the staging site, and restrict access to the staging site.
Exploitation
- No known exploitation.
- Not listed in the CISA KEV catalogue.
- CISA SSVC: exploitation none, automatable no.
- No public proof of concept found.
Our recommendation
- Update the plugin to version 1.22.28 or later.
- Audit Subscriber accounts on staging and live sites and disable open registration.
- Restrict access to staging sites.
- If an affected version ran and the staging site was exposed, check the live site's integrity and availability logs.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan advisory CVE-2026-107237 wpscan.com
- VulDB 424581 vuldb.com
- OpenCVE CVE-2026-107237 app.opencve.io
- Vulners VulnRichment CVE-2026-107237 vulners.com
- Patchstack advisory via Vulners vulners.com
- WordPress.org plugin page wordpress.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:17.
Original description (NVD)
The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a staging site to the live site, allowing any authenticated user with a Subscriber account on a WP Time Capsule staging site to overwrite the separate live site's database and configuration and take it offline.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.