PT-2026-51140 · Wp Time Capsule · Time Capsule Plugin

B. Canavate · Publicado 2026-06-20 · Atualizado 2026-06-20 · CVE-2020-37255

Mitre

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

WordPress Time Capsule Plugin 1.21.16 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain administrative access by sending a crafted POST request with the IWP JSON PREFIX header. Attackers can exploit this flaw to obtain valid administrator session cookies and access the WordPress dashboard without providing credentials.

Exploit

Correção

Authentication Bypass Using an Alternate Path or Channel

Enumeração de Fraquezas

CWE-288

Identificadores relacionados

CVE-2020-37255

Produtos afetados

Time Capsule Plugin

Referências · 4

• 🔥 https://exploit-db.com/exploits/47941 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-37255 · Nota de Segurança
• https://wptimecapsule.com · Nota
• https://vulncheck.com/advisories/wordpress-time-capsule-plugin-authentication-bypass · Nota