{"id":"CVE-2026-107237","kind":"vulnerability","aliases":["CVE-2026-107237"],"related":[],"title":"WP Time Capsule plugin: subscriber can overwrite live WordPress site","description":"The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a staging site to the live site, allowing any authenticated user with a Subscriber account on a WP Time Capsule staging site to overwrite the separate live site's database and configuration and take it offline.","summary":"The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 lets any logged-in Subscriber on a staging site trigger a deploy to the live site without capability or nonce checks. An attacker can overwrite the live site's database and configuration and take it offline.","severity":"high","cvss":8.2,"epss":0.00235,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wp-time-capsule"],"not_affected_if":["no-staging-sites","plugin-version-1.22.28-or-later"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get wp-time-capsule --field=version`\n- Confirm whether a staging site is linked to the live site and whether Subscriber accounts exist on the staging site","fix":"- Update the Backup and Staging by WP Time Capsule plugin to `1.22.28` or later\n- Until updated, restrict or remove Subscriber accounts on staging sites linked to live sites","status":"open","published_at":"2026-10-21T06:16:46+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:03:50+00:00","updated_at":"2026-10-25T03:03:50+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:03:50Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Backup and Staging by WP Time Capsule plugin to `1.22.28` or later\n- Until updated, restrict or remove Subscriber accounts on staging sites linked to live sites","reach":"network","title":"WP Time Capsule plugin: subscriber can overwrite live WordPress site","impact":"high","summary":"The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 lets any logged-in Subscriber on a staging site trigger a deploy to the live site without capability or nonce checks. An attacker can overwrite the live site's database and configuration and take it offline.","category":"package","nicknames":[],"who_cares":["wordpress","wp-time-capsule","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"live site database and configuration overwritten and taken offline","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get wp-time-capsule --field=version`\n- Confirm whether a staging site is linked to the live site and whether Subscriber accounts exist on the staging site","needs_analyst":false,"not_affected_if":["plugin-version-1.22.28-or-later","no-staging-sites"],"who_is_affected":"Sites running the Backup and Staging by WP Time Capsule plugin before 1.22.28 that use its staging feature to deploy to a separate live site. The exposure depends on whether a staging site has user accounts with at least Subscriber access, which is the role the flaw requires. Sites without the plugin or without a linked staging setup can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000636,"input_tokens":3375,"output_tokens":597,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107237':13A,16A '-2026':12A,15A '1.22.28':37B,86C 'account':113C 'allow':106C 'attack':61B 'authent':108C 'backup':27B,76C 'capabl':56B,90C 'capsul':3A,25B,33B,82C,118C 'check':59B,93C 'configur':70B,130C 'cve':11A,14A 'databas':68B,128C 'deploy':50B,98C 'handler':96C 'host':20B 'let':38B 'live':8A,53B,65B,104C,125C 'log':41B 'logged-in':40B 'nonc':58B,92C 'offlin':74B,134C 'overwrit':7A,63B,122C 'packag':17B 'perform':89C 'plugin':4A,35B,84C 'self':19B 'self-host':18B 'separ':124C 'site':10A,47B,54B,66B,101C,105C,120C,126C 'stage':29B,46B,78C,100C,119C 'subscrib':5A,43B,112C 'take':72B,132C 'time':2A,24B,32B,81C,117C 'trigger':48B 'user':109C 'without':55B 'wordpress':9A,21B,34B,83C 'wp':1A,23B,31B,80C,116C 'wp-time-capsul':22B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Backup and Staging by WP Time Capsule plugin before 1.22.28 that use its staging feature to deploy to a separate live site. The exposure depends on whether a staging site has user accounts with at least Subscriber access, which is the role the flaw requires. Sites without the plugin or without a linked staging setup can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T06:16:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107237","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107237","severity":null,"published_at":"2026-10-21T06:16:46+00:00","modified_at":"2026-10-21T18:37:38+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-107237","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107237","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}