CVE-2024-8856: revmakx backup_and_staging_by_wp_time_capsule
Vulnerability summary
CVE-2024-8856 is a critical (CVSS 9.8) vulnerability in revmakx backup_and_staging_by_wp_time_capsule. EPSS estimates a 94.14% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 16-11-2024PublishedVulnerability first disclosed.
- 08-04-2026Last modifiedVulnerability information updated.
Description
The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the the UploadHandler.php file and no direct file access prevention in all versions up to, and including, 1.22.21. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- wordfenceSource9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
94.14%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
+0.13 pp
From 94.00% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundBackup and Staging by WP Time Capsule 1.22.21 - Unauthenticated Arbitrary File Upload
Maturity: poc
WordPress WP Time Capsule Arbitrary File Upload to RCE
exploit/multi/http/wp_time_capsule_file_upload_rce
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Revmakx1 product
- backup_and_staging_by_wp_time_capsule≤ 1.22.21 | < 1.22.22
Wordpress1 product
- wp-time-capsule≤ 1.22.21 (fixed in 1.22.22)
2 vendors · 2 products