CVE-2020-37255

HIGH

WordPress Time Capsule Plugin 1.21.16 Authentication Bypass

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2020-37255 has a selected CVSS score of 8.7 (high); EIP currently links 1 catalogued exploit.

Description

WordPress Time Capsule Plugin 1.21.16 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain administrative access by sending a crafted POST request with the IWP_JSON_PREFIX header. Attackers can exploit this flaw to obtain valid administrator session cookies and access the WordPress dashboard without providing credentials.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 23, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Time Capsule Plugin

Browse Wptimecapsule / Time Capsule Plugin

Default status: unaffected

CVE ListThrough 1.21.16affected

Proofs of concept

1

Catalogued exploits

ExploitDBWordPress Plugin Time Capsule 1.21.16 - Authentication BypassExploitDB exploitby B. CanavateNot analyzed1 file
ExploitDB
PoC details

References

4