PT-2024-9684 · WordPress · Backup/Staging By Wp Time Capsule

Rein Daelman + 1 · Published 2024-09-13 · Updated 2025-07-09 · CVE-2024-8856

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Backup and Staging by WP Time Capsule plugin for WordPress versions up to, and including, 1.22.21

Description The issue is related to arbitrary file uploads due to missing file type validation in the UploadHandler.php file and no direct file access prevention. This allows unauthenticated attackers to upload arbitrary files on the affected site's server, which may make remote code execution possible. The estimated number of potentially affected devices worldwide is over 20,000 sites. The vulnerability can be exploited to inject backdoors or malware and take full control of affected websites.

Recommendations For versions up to, and including, 1.22.21, update the plugin to a version that includes the fix for this issue. As a temporary workaround, consider disabling the UploadHandler.php file until a patch is available. Restrict access to the UploadHandler.php file to minimize the risk of exploitation. Avoid using the plugin until the issue is resolved.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2024-11396

CVE-2024-8856

Affected Products

Backup/Staging By Wp Time Capsule

References · 33

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_time_capsule_file_upload_rce.rb · Exploit
• 🔥 https://github.com/ubaii/CVE-2024-8856 · Exploit
• 🔥 https://exploit-db.com/exploits/52131 · Exploit
• https://plugins.trac.wordpress.org/changeset/3188325 · Patch
• https://bdu.fstec.ru/vul/2024-11396 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-8856 · Security Note
• https://osv.dev/vulnerability/CVE-2024-8856 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3153289%40wp-time-capsule&new=3153289%40wp-time-capsule&sfp_email=&sfph_mail= · Patch
• https://twitter.com/ReinDaelman/status/1859689619690062322 · Twitter Post
• https://hacked.be/posts/CVE-2024-8856 · Note
• https://twitter.com/cracbot/status/1859476893168554390 · Twitter Post
• https://t.me/cvedetector/11225 · Telegram Post
• https://plugins.trac.wordpress.org/browser/wp-time-capsule/trunk/wp-tcapsule-bridge/upload/php/UploadHandler.php · Note
• https://twitter.com/CVEnew/status/1857662796592459796 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1857976144013963667 · Twitter Post