Vulnerability · Published Feb 6, 2020 · Assigned by mitre
CVE-2020-8771
Critical 9.8
In plain English
A critical-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 45.5% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)45.5%top 1.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei
Official description
The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWP_JSON_PREFIX causes the client to be logged in as the first account on the list of administrator accounts.
Affected products (as reported)
References
- https://wpvulndb.com/vulnerabilities/10010 x_refsource_MISC
- https://www.webarxsecurity.com/vulnerability-infinitewp-client-wp-time-capsule/ x_refsource_MISC