CVE-2020-8771

Name of the Vulnerable Software and Affected Versions Time Capsule plugin for WordPress versions prior to 1.21.16

Description The issue allows for an authentication bypass. Specifically, any request containing the prefix IWP JSON PREFIX results in the client being logged in as the first account on the list of administrator accounts.

Recommendations For versions prior to 1.21.16, update to version 1.21.16 or later to resolve the issue. As a temporary workaround, consider restricting access to the Time Capsule plugin until the update is applied.