PT-2020-20263 · WordPress · Time Capsule

Dave Jong · Published 2020-02-06 · Updated 2020-02-11 · CVE-2020-8771

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Time Capsule plugin for WordPress versions prior to 1.21.16

Description The issue allows for an authentication bypass. Specifically, any request containing the prefix IWP JSON PREFIX results in the client being logged in as the first account on the list of administrator accounts.

Recommendations For versions prior to 1.21.16, update to version 1.21.16 or later to resolve the issue. As a temporary workaround, consider restricting access to the Time Capsule plugin until the update is applied.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2020-8771

Affected Products

Time Capsule

References · 4

• 🔥 https://webarxsecurity.com/vulnerability-infinitewp-client-wp-time-capsule · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-8771 · Security Note
• https://osv.dev/vulnerability/CVE-2020-8771 · Vendor Advisory
• https://wpvulndb.com/vulnerabilities/10010 · Note