Vulnerability record · CVE-2020-8771 · published 6 February 2020
CVE-2020-8771: WordPress Time Capsule plugin authentication bypass via IWP_JSON_PREFIX
Wptimecapsule · Wp Time Capsule
The Time Capsule plugin before 1.21.16 for WordPress contains an authentication bypass. Any request containing the string IWP_JSON_PREFIX causes the client to be logged in as the first administrator account in the list. This lets an unauthenticated remote attacker gain full administrative access to the WordPress site.
Description
The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWP_JSON_PREFIX causes the client to be logged in as the first account on the list of administrator accounts.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with no authentication or user interaction required, public exploit reference, and very high EPSS percentile make this an urgent pre-auth admin takeover risk.
What it is
The Time Capsule plugin before 1.21.16 for WordPress contains an authentication bypass. Any request containing the string IWP_JSON_PREFIX causes the client to be logged in as the first administrator account in the list. This lets an unauthenticated remote attacker gain full administrative access to the WordPress site.
Impact
An attacker gains administrator-level access to the WordPress installation without credentials, enabling full control over site content, users, and configuration. The CVSS 3.1 vector shows high confidentiality, integrity, and availability impact.
Attack surface
Reachable over the network via HTTP requests to the WordPress site running the vulnerable plugin; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).
Exploitation
Not listed in CISA KEV, but EPSS probability is 0.46454 (98.764th percentile) and a public exploit reference is tagged 'Exploit', indicating active interest and available exploit code.
What to do
- Update the Time Capsule plugin to version 1.21.16 or later immediately.
- If patching is not possible, disable or remove the Time Capsule plugin until it can be updated.
- Audit administrator accounts and reset credentials for any accounts that may have been accessed.
- Review web server and WordPress logs for requests containing IWP_JSON_PREFIX and block them at the WAF or reverse proxy.
- Restrict access to wp-admin and plugin endpoints where feasible as a defense-in-depth measure.
Detection
- Search HTTP access logs for requests containing the string IWP_JSON_PREFIX.
- Monitor for unexpected creation or modification of administrator accounts in WordPress.
- Alert on authentication events where a session is established without a corresponding login request.
- Review plugin version inventory to identify installations of Time Capsule below 1.21.16.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://wpvulndb.com/vulnerabilities/10010 | Third Party Advisory |
| https://www.webarxsecurity.com/vulnerability-infinitewp-client-wp-time-capsule/ | ExploitThird Party Advisory |
| https://wpvulndb.com/vulnerabilities/10010 | Third Party Advisory |
| https://www.webarxsecurity.com/vulnerability-infinitewp-client-wp-time-capsule/ | ExploitThird Party Advisory |
Track CVE-2020-8771 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-8771), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
