CVE-2026-8996: WP Time Capsule Sensitive Information Exposure – Database Credential Leak

Technical summary

CVE-2026-8996 is an authenticated information disclosure vulnerability in WP Time Capsule plugin versions up to 1.22.26. The vulnerability exists in the download_recent_decrypted_file_wptc function, which does not properly gate access to decrypted backup files stored in the plugin's upload directory. The vulnerability is classified under CWE-862 (Missing Authorization) because the access control fails to restrict retrieval of the 'recent_decrypted_file' option to privileged administrators. The CVSS 3.1 score of 6.5 (MEDIUM) reflects a network-accessible vector requiring valid credentials but no user interaction, with high confidentiality impact but no integrity or availability impact. The attack surface is limited by a prerequisite: the decrypted file must exist, which only occurs after an admin has manually triggered a decryption action.

Business impact

Exploitation of this vulnerability exposes the complete database backup containing user credentials, password hashes, and site configuration data. For sites using weak or reused passwords, attackers can leverage extracted credentials for lateral movement or account takeover. Exposed database contents may also reveal client data, transaction records, or proprietary information depending on site purpose. The risk is compounded for multi-site WordPress installations or sites handling regulated data (PCI, HIPAA, GDPR scope). The ability for low-privileged users (subscribers) to access admin-level backup data represents a significant privilege escalation and data governance violation.

Affected systems

The vulnerability affects all versions of Backup and Staging by WP Time Capsule up to and including version 1.22.26. Any WordPress site running the plugin with any version in this range is potentially at risk if: (1) the site permits subscriber-level user accounts, (2) an administrator has previously performed a decryption action, and (3) the decrypted backup file has not been manually cleaned up from the plugin's upload directory. Sites without subscriber or higher user accounts, or those that never decrypt backups, have lower risk.

Exploitability

The vulnerability requires valid WordPress authentication credentials at subscriber level or above, lowering the barrier to exploitation compared to unauthenticated flaws. However, the prerequisite that a decrypted backup file must exist limits real-world exploitability on sites that do not regularly decrypt backups or that promptly delete temporary decrypted files. The attack requires no user interaction, no special tools, and can be triggered via direct API call or web request. For sites meeting the prerequisites, exploitability is straightforward. The CVSS score of 6.5 reflects this balance: authentication required, but ease of execution once credentials are obtained.

Remediation

Site administrators should immediately update WP Time Capsule to a patched version above 1.22.26. Verify against the vendor's official advisory and changelog for the specific version that resolves CVE-2026-8996. Additionally, administrators should audit the plugin's upload directory to locate and delete any decrypted backup files (typically identifiable by recent modification timestamps and SQL extensions), remove unnecessary subscriber-level user accounts if not required by site purpose, and consider restricting user roles to contributor or above where feasible. For defense-in-depth, implement Web Application Firewall rules to monitor for suspicious access patterns to the download_recent_decrypted_file_wptc endpoint.

Patch guidance

Check the vendor's official plugin repository and advisory page for the patched version number and release date. Apply the update through the WordPress plugin dashboard or via command line tools like WP-CLI. After patching, verify that the plugin version displayed in the Plugins menu reflects the updated version and that no decrypted backup files remain in the plugin's upload directory (typically wp-content/uploads/wptc-backup/ or similar). Test backup and restore functionality to confirm the patch did not break existing workflows.

Detection guidance

Monitor WordPress access logs for requests to the download_recent_decrypted_file_wptc endpoint or parameters, particularly from subscriber-level accounts. Check the plugin's upload directory for recently modified decrypted SQL files (e.g., .sql, .sql.gz) and cross-reference modification timestamps with admin decryption actions logged in the WP Time Capsule activity log (if available). Implement file integrity monitoring on the plugin directory to alert on unauthorized file access. Log all user role changes to catch privilege escalation attempts that might precede exploitation. Use WordPress security plugins like Wordfence or Sucuri that track malicious activity patterns.

Why prioritize this

Although CVSS-scored as MEDIUM, this vulnerability merits rapid patching because: (1) it directly exposes database credentials and password hashes, enabling secondary attacks, (2) it requires only subscriber-level access, a role many sites permit for clients or contributors, (3) the impact is confidentiality-critical for regulated industries, and (4) patches are likely available and straightforward to deploy. Organizations should prioritize this in the 'High' or 'Critical' tier of their patching roadmap despite the CVSS score, especially if subscriber accounts exist on production sites.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) is calculated as: Network-accessible (AV:N), low attack complexity (AC:L), low privilege requirement (PR:L, subscriber level), no user interaction (UI:N), unchanged scope (S:U), high confidentiality impact (C:H), no integrity or availability impact (I:N/A:N). The score is tempered by the authentication requirement and the prerequisite that a decrypted file must already exist. However, the high confidentiality impact reflects the sensitivity of exposed database contents. Organizations handling sensitive data or with broad user bases should consider this a de facto 'High' risk despite the numerical MEDIUM rating.

Frequently asked questions