CVE-2024-8856

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-8856
The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the the UploadHandler.php file and no direct file access prevention in all versions up to, and including, 1.22.21. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS

No CVSS.

References
Link Resource
https://hacked.be/posts/CVE-2024-8856 Product
https://plugins.trac.wordpress.org/browser/wp-time-capsule/trunk/wp-tcapsule-bridge/upload/php/UploadHandler.php Product
https://plugins.trac.wordpress.org/changeset/3188325/ Patch
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3153289%40wp-time-capsule&new=3153289%40wp-time-capsule&sfp_email=&sfph_mail= Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/fdc2de78-5601-461f-b2f0-c80b592ccb1b?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:revmakx:backup_and_staging_by_wp_time_capsule:*:*:*:*:*:wordpress:*:*
History

09 Jul 2025, 18:51

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 9.8 		v2 : unknown
v3 : unknown
CWE CWE-434
First Time Revmakx backup And Staging By Wp Time Capsule
Revmakx
References
  • () https://hacked.be/posts/CVE-2024-8856 - Product
References () https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3153289%40wp-time-capsule&new=3153289%40wp-time-capsule&sfp_email=&sfph_mail= - () https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3153289%40wp-time-capsule&new=3153289%40wp-time-capsule&sfp_email=&sfph_mail= - Patch
References () https://plugins.trac.wordpress.org/changeset/3188325/ - () https://plugins.trac.wordpress.org/changeset/3188325/ - Patch
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/fdc2de78-5601-461f-b2f0-c80b592ccb1b?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/fdc2de78-5601-461f-b2f0-c80b592ccb1b?source=cve - Third Party Advisory
References () https://plugins.trac.wordpress.org/browser/wp-time-capsule/trunk/wp-tcapsule-bridge/upload/php/UploadHandler.php - () https://plugins.trac.wordpress.org/browser/wp-time-capsule/trunk/wp-tcapsule-bridge/upload/php/UploadHandler.php - Product
CPE cpe:2.3:a:revmakx:backup_and_staging_by_wp_time_capsule:*:*:*:*:*:wordpress:*:*

16 Nov 2024, 05:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-16 05:15

Updated : 2025-07-09 18:51

NVD link : CVE-2024-8856

Mitre link : CVE-2024-8856

JSON object : View

Products Affected

revmakx

  • backup_and_staging_by_wp_time_capsule
CWE

No CWE.