CVE-2024-8856

🗓️ 16 Nov 2024 04:29:15Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 151 Views

The WP Time Capsule plugin for WordPress (all versions up to 1.22.21) allows unauthenticated attackers to upload arbitrary files, leading to potential remote code execution

Reporter	Title	Published	Views	Family All 21
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Revmakx Backup_And_Staging_By_Wp_Time_Capsule	21 Nov 202404:01	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Revmakx Backup_And_Staging_By_Wp_Time_Capsule	16 Nov 202420:04	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Revmakx Backup_And_Staging_By_Wp_Time_Capsule	4 Feb 202618:05	–	githubexploit
Circl	CVE-2024-8856	16 Nov 202406:52	–	circl
CNNVD	WordPress plugin Backup and Staging by WP Time Capsule 代码问题漏洞	16 Nov 202400:00	–	cnnvd
Cvelist	CVE-2024-8856 Backup and Staging by WP Time Capsule <= 1.22.21 - Unauthenticated Arbitrary File Upload	16 Nov 202404:29	–	cvelist
Exploit DB	Backup and Staging by WP Time Capsule 1.22.21 - Unauthenticated Arbitrary File Upload	6 Apr 202500:00	–	exploitdb
Metasploit	WordPress WP Time Capsule Arbitrary File Upload to RCE	13 Dec 202418:55	–	metasploit
Nuclei	WP Time Capsule Plugin - Remote Code Execution	3 Jun 202606:04	–	nuclei
NVD	CVE-2024-8856	16 Nov 202405:15	–	nvd

NVD

Vulners

Vulnrichment

Node

revmakx backup_and_staging_by_wp_time_capsuleRange<1.22.22wordpress

[
  {
    "vendor": "revmakx",
    "product": "Backup and Staging by WP Time Capsule",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.22.21",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/wp-time-capsule/trunk/wp-tcapsule-bridge/upload/php/UploadHandler.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/fdc2de78-5601-461f-b2f0-c80b592ccb1b
plugins	www.plugins.trac.wordpress.org/changeset/3188325/
plugins	www.plugins.trac.wordpress.org/changeset
hacked	www.hacked.be/posts/CVE-2024-8856

08 Apr 2026 17:35Current

9.8High risk

Vulners AI Score9.8

CVSS 3.19.8

EPSS0.93149

SSVC