CVE-2026-107237: Backup and Staging by WP Time Capsule < 1.22.28 - Subscriber+ Staging-to-Live Deployment via wptc_copy_stage_to_live

Q: Who can exploit this issue?

Any authenticated user with a Subscriber account or higher on a WP Time Capsule staging site can exploit it. The attacker does not need administrative privileges because the affected handler lacks capability and nonce checks.

Q: What systems are at risk?

WP Time Capsule staging sites running a version before 1.22.28 are at risk when they are configured to deploy to a separate live site. Exploitation can overwrite the live site's database and configuration, potentially taking the live site offline.

Q: What should be done if an immediate update is not possible?

Restrict or remove Subscriber and other nonessential authenticated accounts on affected staging sites until the plugin can be updated. Limit access to the staging site because any authenticated Subscriber-level account can invoke the vulnerable deployment handler.

Published Oct 21, 2026

Updated

The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a staging site to the live site, allowing any authenticated user with a Subscriber account on a WP Time Capsule staging site to overwrite the separate live site's database and configuration and take it offline.

Affected Software

1 affected component

WP Time Capsule Backup and Staging by WP Time Capsule<1.22.28

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Backup and Staging by WP Time Capsule to a version that resolves this vulnerability.
Fixed in 1.22.28

Event History

Oct 21, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated user with a Subscriber account or higher on a WP Time Capsule staging site can exploit it. The attacker does not need administrative privileges because the affected handler lacks capability and nonce checks.

What systems are at risk?

WP Time Capsule staging sites running a version before 1.22.28 are at risk when they are configured to deploy to a separate live site. Exploitation can overwrite the live site's database and configuration, potentially taking the live site offline.

What should be done if an immediate update is not possible?

Restrict or remove Subscriber and other nonessential authenticated accounts on affected staging sites until the plugin can be updated. Limit access to the staging site because any authenticated Subscriber-level account can invoke the vulnerable deployment handler.

CVE-2026-107237: Backup and Staging by WP Time Capsule < 1.22.28 - Subscriber+ Staging-to-Live Deployment via wptc_copy_stage_to_live

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What systems are at risk?

What should be done if an immediate update is not possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What systems are at risk?

What should be done if an immediate update is not possible?