CVE-2024-8856

The Backup and Staging by WP Time Capsule WordPress plugin (all versions up to and including 1.22.21) fails to validate file types in its UploadHandler.php file and does not prevent direct access to uploaded files, making it vulnerable to unauthenticated arbitrary file uploads (CWE-434). An unauthenticated remote attacker can reach the upload handler over the network and upload arbitrary files, such as PHP scripts, to the affected site's server. Because uploaded files are not protected from direct access, an attacker may be able to execute the uploaded files, potentially achieving full remote code execution and compromise of the site and its host. Any WordPress site running the plugin at version 1.22.21 or earlier is affected. The flaw is not yet listed in CISA KEV and no public proof-of-concept is known, but the 94% EPSS score (100th percentile) indicates a very high probability of exploitation within the next 30 days.

What to do: Upgrade Backup and Staging by WP Time Capsule to version 1.22.22 or later, which adds file-type validation and direct-access prevention for uploads. Until patched, block or restrict unauthenticated access to the plugin's UploadHandler.php endpoint (e.g., via WAF rules) and audit upload directories for unexpected PHP files. Review web server logs for suspicious unauthenticated POST requests to the upload handler to identify potential exploitation.