SEPTEMBER 20, 2026
Live Feed
Back to database
Case File

CVE-2026-8996

MEDIUM · CVSS 6.5 EPSS 0.26% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-09 · Last synced 2026-08-08

CyberRota Analysis

AI-Generated

The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to sensitive information exposure, allowing authenticated attackers with subscriber-level access or higher to download the most recent decrypted SQL database backup. This backup may contain critical data such as password hashes and user credentials, posing a significant risk to site security. WordPress site administrators using this plugin should prioritize applying the necessary updates to mitigate potential exploitation.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
exploit

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-8996
Severity
MEDIUM
CVSS
6.5
EPSS
0.26%
WordPress

Original NVD Description

The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.22.26 via the download_recent_decrypted_file_wptc. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract download the most recently admin-decrypted SQL database backup, which typically contains password hashes, user credentials, and other sensitive site configuration data stored in the 'recent_decrypted_file' option. Exploitation requires that an administrator has previously performed a decrypt action, causing the decrypted SQL backup file to exist in the plugin's upload directory; without this prior admin action, there is no file to serve.