Live › vulnerability › CVE-2026-107237
Go to dashboardThe Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 lets any logged-in Subscriber on a staging site trigger a deploy to the live site without capability or nonce checks. An attacker can overwrite the live site's database and configuration and take it offline.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Backup and Staging by WP Time Capsule plugin before 1.22.28 that use its staging feature to deploy to a separate live site. The exposure depends on whether a staging site has user accounts with at least Subscriber access, which is the role the flaw requires. Sites without the plugin or without a linked staging setup can skip it.
No product ranges from the sources yet.
wp plugin get wp-time-capsule --field=version1.22.28 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a staging site to the live site, allowing any authenticated user with a Subscriber account on a WP Time Capsule staging site to overwrite the separate live site's database and configuration and take it offline.
This page as .md · .json · in your agent: get_signal("CVE-2026-107237")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.