CVE-2026-107237 WP Time Capsule CVE debrief

Who should care

Defenders responsible for WordPress installations using the Backup and Staging by WP Time Capsule plugin should assess exposure and prioritize upgrading to version 1.22.28 or later.

Why it matters

CVE-2026-107237 allows authenticated users with Subscriber accounts on WP Time Capsule staging sites to deploy staging sites to live sites, potentially overwriting live site data and causing downtime. Defenders should verify exposure, restrict access to staging sites, and prioritize upgrading to version 1.22.28 or later.

• Potential unauthorized deployment of staging sites to live sites
• Possible overwrite of live site database and configuration
• Potential for live site downtime or data loss

Technical summary

The Backup and Staging by WP Time Capsule plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a staging site to the live site, allowing any authenticated user with a Subscriber account on a WP Time Capsule staging site to overwrite the separate live site's database and configuration and take it offline. This vulnerability is caused by inadequate access controls and lack of validation in the plugin's deployment process. Defenders should prioritize verifying exposure of WP Time Capsule staging sites and upgrading to version 1.22.28 or later.

Defensive priority

Defenders should prioritize verifying exposure of WP Time Capsule staging sites and upgrading to version 1.22.28 or later.

Recommended defensive actions

• Verify WP Time Capsule plugin version and upgrade to 1.22.28 or later if necessary
• Restrict access to staging sites to authorized personnel only
• Monitor for suspicious activity on live sites following staging site deployments
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program and NVD records provide details on the vulnerability, but do not specify versions or remediation beyond upgrading to 1.22.28 or later. The vulnerability allows authenticated users with Subscriber accounts on WP Time Capsule staging sites to deploy staging sites to live sites, overwriting live site data and causing downtime. Defenders should verify exposure, restrict access to staging sites, and prioritize upgrading to version 1.22.28 or later. Evidence is limited, and defenders should review official advisories and CVE

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.