What the vulnerability does
01Description
The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.22.26 via the download_recent_decrypted_file_wptc. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract download the most recently admin-decrypted SQL database backup, which typically contains password hashes, user credentials, and other sensitive site configuration data stored in the 'recent_decrypted_file' option. Exploitation requires that an administrator has previously performed a decrypt action, causing the decrypted SQL backup file to exist in the plugin's upload directory; without this prior admin action, there is no file to serve.
Explanation of Vulnerability in Simple Terms
02Summary
Backup and Staging by WP Time Capsule versions 1.22.26 and earlier do not properly check user permissions before allowing access to sensitive backup and staging functions. A logged-in user with low privileges can read backup data and staging environment details without authorization. Update to a version newer than 1.22.26.
What an attacker can do
03Attacker Capabilities
Read backup files and staging environment data without proper authorization.
Potential impact on your site
04Site Impact
Backup contents and staging site data may be exposed to any logged-in user, risking data leakage.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
06Disclosure timeline
July 9, 2026
CVE published
July 9, 2026
Record updated
