CVE-2024-8856criticalexploração observadaCWE-434

CVE-2024-8856: falha crítica em revmakx Backup and Staging by WP Time Capsule

Backup and Staging by WP Time Capsule <= 1.22.21 - Unauthenticated Arbitrary File Upload

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Backup and Staging by WP Time Capsule

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

100Vexday Risk Score

Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.

ssvc Actcvss 9.8epss 94%
da publicação à armano mesmo dia
Publicada no NVD16 de nov.
1ª PoC16 de nov.
metasploit15 de nov.
VulnCheck+123d
The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the the UploadHandler.php file and no direct file access prevention in all versions up to, and including, 1.22.21. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
revmakx · Backup and Staging by WP Time Capsule
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — revmakx Backup and Staging by WP Time Capsule

No mesmo produto, das mais perigosas para as menos.

CVE-2024-49684HIGHWordPress Backup and Staging by WP Time Capsule plugin <= 1.22.21 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2024-48020HIGHWordPress Backup and Staging by WP Time Capsule plugin <= 1.22.21 - SQL Injection vulnerabilityEPSS 0.5%CVE-2026-8996MEDIUMBackup and Staging by WP Time Capsule <= 1.22.26 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via download_recent_decrypted_file_wptc FunctionEPSS 0.5%CVE-2026-42760HIGHWordPress Backup and Staging by WP Time Capsule plugin <= 1.22.25 - Broken Authentication vulnerabilityEPSS 0.3%CVE-2025-47477HIGHWordPress Backup and Staging by WP Time Capsule plugin <= 1.22.23 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%