Key points
- CVE-2026-107237 affects WP Time Capsule versions prior to 1.22.28.
- The flaw allows authenticated subscribers to overwrite live site databases.
- The vendor has released a patch that adds required capability checks.
Site administrators using the Backup and Staging by WP Time Capsule WordPress plugin must update to version 1.22.28 immediately. The National Vulnerability Database records this issue as CVE-2026-107237 with a CVSS score of 8.2, which classifies it as high severity. The vulnerability exists in all versions of the plugin before the latest release. Users of older versions are exposed to risks that allow unauthorized changes to their production environments.
In plain English
The plugin failed to verify user permissions when deploying a staging site to a live site. This missing check meant that any user with a Subscriber account on the staging environment could trigger the deployment. Consequently, these low-privilege users could overwrite the separate live site's database and configuration files. This action could take the live website offline or alter its core settings without proper authorization.
The background
According to the NVD record, the handler responsible for moving data from staging to live did not perform necessary capability or nonce checks. Nonces are security tokens that prevent unauthorized actions in WordPress. Without these checks, the system trusted any authenticated request to proceed with the deployment. This design flaw effectively bypassed the standard role-based access controls that should restrict such powerful actions to administrators only.
What changes now
The vendor has released version 1.22.28 to address this specific security gap. This update introduces the missing capability and nonce verifications for the deployment handler. Installing this version ensures that only users with the appropriate administrative privileges can push changes from staging to the live site. Subscribers on the staging site will no longer be able to overwrite the live database or configuration through this mechanism.
Who needs to act first
Teams usually prioritize systems that are directly accessible to the public or external users. Check whether your staging environments allow any level of user registration. If subscribers can log in to staging areas, update those sites immediately to prevent database overwrites. Back up your live site configuration before applying the plugin update to ensure you can restore settings if the update causes compatibility issues. Test the update in a isolated environment first to verify that deployment workflows remain functional and that permission restrictions are correctly enforced after the patch.
What to do and how to stay safe: WP Time Capsule
- Verify the current version of the Backup and Staging by WP Time Capsule plugin on all managed WordPress sites.
- Update the plugin to version 1.22.28 or later to apply the security fix.
- Review user roles on staging sites to ensure subscribers do not have unnecessary access.
- Monitor site logs for any unauthorized deployment attempts following the update.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE ID for this vulnerability?
The vulnerability is tracked as CVE-2026-107237.
Which versions of the plugin are affected?
All versions of Backup and Staging by WP Time Capsule before 1.22.28 are affected.
What can an attacker do with this flaw?
An authenticated subscriber can overwrite the live site's database and configuration, potentially taking it offline.
