CVE-2020-8771

CRITICALNuclei

WordPress Time Capsule < 1.21.16 - Authentication Bypass

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2020-8771 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWP_JSON_PREFIX causes the client to be logged in as the first account on the list of administrator accounts.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryCRITICALWordPress Time Capsule < 1.21.16 - Authentication BypassCVSS 9.8

WordPress Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWP_JSON_PREFIX causes the client to be logged in as the first account on the list of administrator accounts.

Impact

An attacker can bypass authentication and gain unauthorized access to the WordPress Time Capsule plugin.

Remediation

Update WordPress Time Capsule plugin to version 1.21.16 or later.

WeaknessesCWE-287
Authorsprincechaddha
Template tagscvecve2020wordpresswp-pluginwptimecapsulevuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:wptimecapsule:wp_time_capsule:*:*:*:*:*:wordpress:*:*
https://github.com/SECFORCE/WPTimeCapsulePOC https://nvd.nist.gov/vuln/detail/CVE-2020-8771 https://wpvulndb.com/vulnerabilities/10010 https://www.webarxsecurity.com/vulnerability-infinitewp-client-wp-time-capsule/ https://github.com/HycCodeQL/wordpress

Source: ProjectDiscovery

References

3