WordPress Plugin Vulnerabilities

Backup and Staging by WP Time Capsule < 1.22.26 - Missing Authorization

Description

The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.22.25. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
wp-time-capsule
Fixed in 1.22.26

References

CVE
CVE-2026-42760
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/c9160eb6-959e-4181-96ec-8e26beb0b239

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
dodoh4t
Verified
No
WPVDB ID
ed0cefec-1fb6-49e6-8a3f-b2c48dde352c

Timeline

Publicly Published
2026-05-30 (about 2 months ago)
Added
2026-06-11 (about 2 months ago)
Last Updated
2026-06-11 (about 2 months ago)

Other

Published
Title
Published
2026-04-21
Title
Booking Package < 1.7.07 - Missing Authorization
Published
2026-05-26
Title
E-cab Taxi Booking Manager for Woocommerce < 2.0.2 - Missing Authorization
Published
2024-03-19
Title
Order Tip for WooCommerce < 1.4.0 - Missing Authorization to Unauthenticated Data Export
Published
2025-01-16
Title
Slides & Presentations <= 0.0.39 - Missing Authorization to Content Injection
Published
2026-02-11
Title
LearnPress Export Import < 4.1.1 - Missing Authentication to Unauthenticated Migrated Course Deletion