{"id":"CVE-2026-107237","title":"Backup and Staging by WP Time Capsule < 1.22.28 - Subscriber+ Staging-to-Live Deployment via wptc_copy_stage_to_live","summary":"The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a staging site to the live site, allowing any authenticated user with a Subscriber account …","severity":"high","cvss":8.2,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H","cvssSource":"adp","cwe":["CWE-862"],"product":"Backup and Staging by WP Time Capsule","affected":["backup_and_staging_by_wp_time_capsule < 1.22.28"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-21T10:22:30.708698Z"},"published":"2026-10-21","updated":"2026-10-21","sourceUpdated":"2026-10-21T10:35:05.744Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-107237","references":[{"url":"https://wpscan.com/vulnerability/e9960aef-88c8-4a74-b479-55be75c25360/"}],"tags":["cve.org"],"ingestedAt":"2026-10-21T06:42:48.184Z","epss":0.00298,"epssPercentile":0.22387,"slug":"CVE-2026-107237","body":"## Overview\n\nThe Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a staging site to the live site, allowing any authenticated user with a Subscriber account on a WP Time Capsule staging site to overwrite the separate live site's database and configuration and take it offline.\n\n## Affected\n\n- `backup_and_staging_by_wp_time_capsule < 1.22.28`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":45.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":226902,"id":"CVE-2026-107237","ts":1792579631401,"field":"cvss","old":null,"new":"8.2"},{"seq":226901,"id":"CVE-2026-107237","ts":1792579631401,"field":"severity","old":"none","new":"high"}]}