CVE-2026-8996 Missing authorization in Backup and Staging by WP Time Capsule
Authenticated subscribers can download sensitive decrypted database backups containing credentials if an admin previously triggered a decryption action.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-8996?
CVE-2026-8996 is a medium-severity missing authorization vulnerability in revmakx Backup and Staging by WP Time Capsule, published on 9 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.22.26 via the download_recent_decrypted_file_wptc. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract download the most recently admin-decrypted SQL database backup, which typically contains password hashes, user credentials, and other sensitive site configuration data stored in the 'recent_decrypted_file' option. Exploitation requires that an administrator has previously performed a decrypt action, causing the decrypted SQL backup file to exist in the plugin's upload directory; without this prior admin action, there is no file to serve.
Weakness: CWE-862
Which versions are affected by CVE-2026-8996?
How do I fix CVE-2026-8996?
No fix has been published for CVE-2026-8996 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-8996 being exploited?
There is no known exploitation of CVE-2026-8996 in the wild and no public exploit code.
Sources
Also known as GHSA-cxpp-m57j-hhq8.