Executive brief
WP Time Capsule is a WordPress plugin used for automated incremental backups and site staging. A security flaw allows unauthorized individuals to bypass the login screen and gain full administrative access to the website. This could lead to the theft of sensitive customer data, site defacement, or the installation of malicious software.
Technical details
An authentication bypass vulnerability exists in the WP Time Capsule plugin for WordPress due to improper validation of specific request headers. By sending a crafted POST request containing the 'IWP_JSON_PREFIX' header, an unauthenticated remote attacker can trigger a logic flaw that returns valid administrator session cookies. This vulnerability is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel). Successful exploitation allows an attacker to access the WordPress dashboard with full administrative privileges without providing credentials. The issue is resolved in version 1.21.16.
Affected products
- Wptimecapsule Time Capsule Plugin < 1.21.16
Timeline
- 2020-01-16: disclosed: Initial discovery and PoC development by B. Canavate
- 2020-01-17: other: Exploit published on Exploit-DB
- 2026-06-20: advisory: NVD/VulnCheck advisory published