Vulnerability · Published Jun 20, 2026 · Assigned by VulnCheck

CVE-2020-37255WordPress Time Capsule Plugin 1.21.16 Authentication Bypass

High 7.5

In plain English

A high-severity authentication bypass in Time Capsule Plugin from Wptimecapsule. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 49.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

WordPress Time Capsule Plugin 1.21.16 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain administrative access by sending a crafted POST request with the IWP_JSON_PREFIX header. Attackers can exploit this flaw to obtain valid administrator session cookies and access the WordPress dashboard without providing credentials.

Affected products (as reported)

Vendor	Product	Versions
Wptimecapsule	Time Capsule Plugin	0 – through 1.21.16

Weakness: CWE-288 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

ExploitDB-47941 exploit
Official Product Homepage product
VulnCheck Advisory: WordPress Time Capsule Plugin 1.21.16 Authentication Bypass third-party-advisory