CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Deserialization of Untrusted Data vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows Object Injection.This issue affects Backup and Staging by WP Time Capsule: from n/a through <= 1.22.21.
Explanation of Vulnerability in Simple Terms
WP Time Capsule versions up to 1.22.21 contain a deserialization vulnerability that allows authenticated administrators to execute arbitrary PHP code on the site. An attacker with admin access can craft malicious serialized data that, when processed by the plugin, runs their own code with full site privileges. This requires high-level access but poses a critical risk if admin credentials are compromised.
What an attacker can do
Run arbitrary PHP code on the site with full administrative privileges.
Potential impact on your site
If admin credentials are compromised, an attacker can take complete control of the site, modify content, steal data, or install malware.
Conditions required to exploit
Attacker must have WordPress administrator account access; no user interaction required.
Key dates
External resources
Related vulnerabilities
