CVE-2026-107237
Backup and Staging by WP Time Capsule < 1.22.28 - Subscriber+ Staging-to-Live Deployment via wptc_copy_stage_to_live
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a staging site to the live site, allowing any authenticated user with a Subscriber account on a WP Time Capsule staging site to overwrite the separate live site's database and configuration and take it offline.
| Vendor | unknown |
| Product | backup and staging by wp time capsule |
| Published | Oct 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown backup and staging by wp time capsule
Be the first to know when new unknown vulnerabilities affecting unknown backup and staging by wp time capsule are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Backup and Staging by WP Time Capsule
0 < 1.22.28
References
Credits
Het Kalariya WPScan