CVE-2024-8856
📋 TL;DR
The Backup and Staging by WP Time Capsule WordPress plugin allows unauthenticated attackers to upload arbitrary files due to missing file type validation. This vulnerability affects all versions up to 1.22.21 and can lead to remote code execution on vulnerable WordPress sites.
💻 Affected Systems
- Backup and Staging by WP Time Capsule WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise via remote code execution, allowing attackers to install malware, steal data, deface websites, or pivot to internal networks.
Likely Case
Attackers upload web shells to gain persistent access, install cryptocurrency miners, or use the server for phishing campaigns.
If Mitigated
If proper file upload validation and web application firewalls are in place, exploitation attempts would be blocked or detected.
🎯 Exploit Status
Simple HTTP POST requests with malicious files can exploit this vulnerability without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.22.22
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3188325/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Backup and Staging by WP Time Capsule'. 4. Click 'Update Now' if available, or manually update to version 1.22.22+. 5. Verify the plugin is updated.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily disable the WP Time Capsule plugin until patched.
wp plugin deactivate wp-time-capsule
Web Application Firewall rule
allBlock requests to vulnerable upload endpoints.
Location: /wp-content/plugins/wp-time-capsule/wp-tcapsule-bridge/upload/php/
🧯 If You Can't Patch
- Implement strict file upload validation at web server level
- Restrict PHP execution in upload directories using .htaccess or nginx configuration
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins for WP Time Capsule version ≤1.22.21Check Version:
wp plugin get wp-time-capsule --field=versionVerify Fix Applied:
Confirm plugin version is 1.22.22 or higher in WordPress admin panel📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /wp-content/plugins/wp-time-capsule/wp-tcapsule-bridge/upload/php/ with suspicious file extensions (.php, .phtml, .phar)
Network Indicators:
- Unusual outbound connections from web server after file upload attempts
SIEM Query:
source="web_server_logs" AND uri="/wp-content/plugins/wp-time-capsule/wp-tcapsule-bridge/upload/php/" AND method="POST"🔗 References
- https://hacked.be/posts/CVE-2024-8856
- https://plugins.trac.wordpress.org/browser/wp-time-capsule/trunk/wp-tcapsule-bridge/upload/php/UploadHandler.php
- https://plugins.trac.wordpress.org/changeset/3188325/
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3153289%40wp-time-capsule&new=3153289%40wp-time-capsule&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/fdc2de78-5601-461f-b2f0-c80b592ccb1b?source=cve
