Vulnerability · Published Oct 21, 2026 · Assigned by WPScan

CVE-2026-107237Backup and Staging by WP Time Capsule < 1.22.28 - Subscriber+ Staging-to-Live Deployment via wptc_copy_stage_to_live

High 8.2

In plain English

A high-severity missing authorization in Backup and Staging by WP Time Capsule from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.3%top 77.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a staging site to the live site, allowing any authenticated user with a Subscriber account on a WP Time Capsule staging site to overwrite the separate live site's database and configuration and take it offline.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Backup and Staging by WP Time Capsule	0 – before 1.22.28

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H

References

https://wpscan.com/vulnerability/e9960aef-88c8-4a74-b479-55be75c25360/ exploit, vdb-entry, technical-description