CVE-2020-8771
Critical
Description
The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWP_JSON_PREFIX causes the client to be logged in as the first account on the list of administrator accounts.
SeverityCritical
CVSS9.8
Exploit probability—
ProductWptimecapsule Wp Time Capsule
PublishedFeb 6, 2020
First seenFeb 6, 2020
How to fix
Update
- wptimecapsule wp_time_capsule1.21.16 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wptimecapsule wp_time_capsule | v < 1.21.16 | 1.21.16 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.