CVE-2024-8856: WP Time Capsule plugin unauthenticated arbitrary file upload

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication, and high EPSS make this an urgent unauthenticated RCE risk.

What it is

The Backup and Staging by WP Time Capsule WordPress plugin fails to validate file types in UploadHandler.php and does not prevent direct access to that file in versions up to and including 1.22.21. This lets unauthenticated attackers upload arbitrary files to the site's server, which can lead to remote code execution. The flaw is trivially reachable over the network with no credentials or user interaction.

Impact

An attacker can place arbitrary files, including executable PHP, on the web server and potentially achieve remote code execution, giving full control of the WordPress site and its data.

Attack surface

Reached over the network via HTTP requests to the plugin's UploadHandler.php endpoint; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.94004, 99.8th percentile), indicating strong likelihood of exploitation; references include patch and third-party advisory links but no public exploit tag.

What to do

• Update the WP Time Capsule plugin to a version newer than 1.22.21 using the available patch changesets.
• If patching is not immediately possible, disable or remove the plugin until it can be updated.
• Block direct HTTP access to the plugin's wp-tcapsule-bridge/upload/php/UploadHandler.php path at the web server or WAF.
• Enforce server-side file type and extension validation and disable PHP execution in WordPress upload directories.
• Audit the site for unexpected files in upload and plugin directories after exposure.

Detection

• Monitor web server logs for POST requests to wp-tcapsule-bridge/upload/php/UploadHandler.php, especially from unauthenticated clients.
• Alert on newly created files in WordPress upload directories, particularly files with PHP or executable extensions.
• Scan the filesystem for unexpected or recently modified files under wp-content and plugin directories.
• Review WAF and access logs for upload attempts with suspicious content types or filenames.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.