The vulnerability in the UploadHandler.php script of the WP Time Capsule plugin for WordPress content management system allows a hacker to upload arbitrary files and execute arbitrary code.

🗓️ 21 Dec 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 3 Views

Vulnerability in WordPress Time Capsule UploadHandler allows unlimited dangerous file uploads and arbitrary code execution.

Reporter	Title	Published	Views	Family All 22
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Revmakx Backup_And_Staging_By_Wp_Time_Capsule	21 Nov 202404:01	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Revmakx Backup_And_Staging_By_Wp_Time_Capsule	16 Nov 202420:04	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Revmakx Backup_And_Staging_By_Wp_Time_Capsule	4 Feb 202618:05	–	githubexploit
Circl	CVE-2024-8856	16 Nov 202406:52	–	circl
CNNVD	WordPress plugin Backup and Staging by WP Time Capsule 代码问题漏洞	16 Nov 202400:00	–	cnnvd
CVE	CVE-2024-8856	16 Nov 202404:29	–	cve
Cvelist	CVE-2024-8856 Backup and Staging by WP Time Capsule <= 1.22.21 - Unauthenticated Arbitrary File Upload	16 Nov 202404:29	–	cvelist
Exploit DB	Backup and Staging by WP Time Capsule 1.22.21 - Unauthenticated Arbitrary File Upload	6 Apr 202500:00	–	exploitdb
Metasploit	WordPress WP Time Capsule Arbitrary File Upload to RCE	13 Dec 202418:55	–	metasploit
Nuclei	WP Time Capsule Plugin - Remote Code Execution	28 Jun 202615:08	–	nuclei

Vulners

Node

wordpress wp_time_capsuleRange≤1.22.21

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-time-capsule/backup-and-staging-by-wp-time-capsule-12221-unauthenticated-arbitrary-file-upload
plugins	www.plugins.trac.wordpress.org/changeset
plugins	www.plugins.trac.wordpress.org/changeset/3188325/
plugins	www.plugins.trac.wordpress.org/browser/wp-time-capsule/trunk/wp-tcapsule-bridge/upload/php/UploadHandler.php
github	www.github.com/ubaii/CVE-2024-8856
securityonline	www.securityonline.info/cve-2024-8856-wp-time-capsule-plugin-vulnerability-exposes-20000-sites-to-takeover/
vuldb	www.vuldb.com/
hacked	www.hacked.be/posts/CVE-2024-8856
web	www.web.nvd.nist.gov/view/vuln/detail

21 Dec 2024 00:00Current

8.2High risk

Vulners AI Score8.2

CVSS 39.8

CVSS 210

EPSS0.93709

WordPress plugin UploadHandler dangerous file types arbitrary code execution file upload vulnerability