---
id: CVE-2026-107237
title: >-
  Backup and Staging by WP Time Capsule < 1.22.28 - Subscriber+ Staging-to-Live
  Deployment via wptc_copy_stage_to_live
summary: >-
  The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does
  not perform capability or nonce checks on the handler that deploys a staging
  site to the live site, allowing any authenticated user with a Subscriber
  account …
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H'
cvssSource: adp
cwe:
  - CWE-862
product: Backup and Staging by WP Time Capsule
affected:
  - backup_and_staging_by_wp_time_capsule < 1.22.28
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-21T10:22:30.708698Z'
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T10:35:05.744Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-107237'
references:
  - url: 'https://wpscan.com/vulnerability/e9960aef-88c8-4a74-b479-55be75c25360/'
tags:
  - cve.org
ingestedAt: '2026-10-21T06:42:48.184Z'
epss: 0.00298
epssPercentile: 0.22387
---

## Overview

The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a staging site to the live site, allowing any authenticated user with a Subscriber account on a WP Time Capsule staging site to overwrite the separate live site's database and configuration and take it offline.

## Affected

- `backup_and_staging_by_wp_time_capsule < 1.22.28`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.