CVE-2026-8996 Details
Description
The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.22.26 via the download_recent_decrypted_file_wptc. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract download the most recently admin-decrypted SQL database backup, which typically contains password hashes, user credentials, and other sensitive site configuration data stored in the 'recent_decrypted_file' option. Exploitation requires that an administrator has previously performed a decrypt action, causing the decrypted SQL backup file to exist in the plugin's upload directory; without this prior admin action, there is no file to serve.
A vulnerability allowing sensitive information exposure has been identified in the Backup and Staging by WP Time Capsule plugin for WordPress, affecting all versions through 1.22.26. The issue arises in the download_recent_decrypted_file_wptc function, where authenticated attackers with subscriber-level access or higher can download the most recently decrypted SQL database backup. This backup, stored in the 'recent_decrypted_file' option, typically contains password hashes, user credentials, and other sensitive site configuration data. Exploitation of this vulnerability requires that an administrator has previously decrypted a backup, leaving the file available in the plugin's upload directory.
Users are advised to update the Backup and Staging by WP Time Capsule plugin to version 1.22.27 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 9, 2026CISA-ADP
Assessed Jul 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WP Time Capsule | <= 1.22.26 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 9, 2026 | New CVE Received | [email protected] |