CVE-2024-8856

High PUBLISHED

Backup and Staging by WP Time Capsule <= 1.22.21 - Unauthenticated Arbitrary File Upload

revmakx · Backup and Staging by WP Time Capsule

Not yet in CISA KEV

Exploited in the wild PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

High

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

Not yet in CISA KEV

CVSS / EPSS

9.8 Critical

At a Glance

The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the the UploadHandler.php file and no direct file access prevention in all versions up to, and including, 1.22.21. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

nuclei_scanner

CVE Published: Nov 16, 2024
Exploitation Reported: Jun 03, 2026
CVSS: 9.8 Critical
EPSS: —

Remote Low complexity No user interaction Unauthenticated

Affected Versions

Vendor	Product	Version	Status
revmakx	backup_and_staging_by_wp_time_capsule	0 to <= 1.22.21	Affected
revmakx	Backup and Staging by WP Time Capsule	* to <= 1.22.21	Affected

CVE References

wordfence.com/threat-intel/vulnerabilities/id/fdc2de78-560... wordfence.com · CVE Record https://www.wordfence.com/threat-intel/vulnerabilities/id/fdc2de78-56...
plugins.trac.wordpress.org/browser/wp-time-capsule/trunk/wp-tcapsule-br... plugins.trac.wordpress.org · CVE Record https://plugins.trac.wordpress.org/browser/wp-time-capsule/trunk/wp-t...
plugins.trac.wordpress.org/changeset/3188325 plugins.trac.wordpress.org · CVE Record https://plugins.trac.wordpress.org/changeset/3188325/
plugins.trac.wordpress.org/changeset plugins.trac.wordpress.org · CVE Record https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&re...
hacked.be/posts/CVE-2024-8856 hacked.be · CVE Record https://hacked.be/posts/CVE-2024-8856

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
The Shadowserver First	2025-06-26 00:00 UTC

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8856.yaml	Apr 25, 2025
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_time_capsule_file_upload_rce.rb	Apr 28, 2025

CVSS Scores

CVSS v3.1 9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitation Status

Exploited in the wild

Recorded 2026-06-03 00:00:00 UTC · The Shadowserver

Proof of concept available

Recorded 2024-11-21 04:01:27 UTC · GitHub

Weaknesses (CWE)

CWE-434

Unrestricted Upload of File with Dangerous Type

Scanner Integrations

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_time_capsule_file_upload_rce.rb	Apr 28, 2025
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8856.yaml	Apr 25, 2025

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

Jenderal92/CVE-2024-8856

github · Created 2024-11-21 04:01:27 UTC · 2 stars

This tool scans WordPress websites for vulnerabilities in the WP Time Capsule plugin related to CVE-2024-8856. It identifies plugin versions below 1.22.22 as vulnerable and logs results to vuln.txt. Simple and efficient, it helps security researchers and admins detect and address risks quickly.

ubaydev/CVE-2024-8856

github · Created 2024-11-16 20:04:11 UTC · 2 stars

WordPress WP Time Capsule Plugin Arbitrary File Upload Vulnerability

WP Time Capsule Plugin - Remote Code Execution

nuclei · Created Unknown

wp_time_capsule_file_upload_rce

metasploit · Created Unknown

Metasploit module for CVE-2024-8856

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2024-8856

{
  "cve_id": "CVE-2024-8856",
  "title": "Backup and Staging by WP Time Capsule <= 1.22.21 - Unauthenticated Arbitrary ...",
  "affected_vendor": "revmakx",
  "affected_product": "Backup and Staging by WP Time Capsule",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "High",
  "cvss_score": 9.8,
  "epss_score": null,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2024-8856

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API