What’s Vulnerable › Vulnerabilities

CVE-2020-8771

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 46.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-02-06 · updated 2026-06-17
• Weakness: CWE-287

Description

The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWP_JSON_PREFIX causes the client to be logged in as the first account on the list of administrator accounts.

Affected products

• Wptimecapsule Wp Time Capsule: before 1.21.16 — fixed in 1.21.16

How to fix

Upgrade to a fixed version: Wptimecapsule Wp Time Capsule 1.21.16. Check the vendor advisory for mitigations.

References

• https://wpvulndb.com/vulnerabilities/10010
• https://www.webarxsecurity.com/vulnerability-infinitewp-client-wp-time-capsule/
• https://wpvulndb.com/vulnerabilities/10010
• https://www.webarxsecurity.com/vulnerability-infinitewp-client-wp-time-capsule/

Get alerted when CVE-2020-8771 or the next vulnerability affects your stack