Backup and Staging by WP Time Capsule Sensitive Information Exposure Vulnerability

A vulnerability allowing sensitive information exposure has been identified in the Backup and Staging by WP Time Capsule plugin for WordPress, affecting all versions through 1.22.26. The issue arises in the download_recent_decrypted_file_wptc function, where authenticated attackers with subscriber-level access or higher can download the most recently decrypted SQL database backup. This backup, stored in the 'recent_decrypted_file' option, typically contains password hashes, user credentials, and other sensitive site configuration data. Exploitation of this vulnerability requires that an administrator has previously decrypted a backup, leaving the file available in the plugin's upload directory.

Impact

Successful exploitation allows authenticated users with subscriber-level access and above to download sensitive SQL database backups that contain password hashes, user credentials, and other confidential site configuration data.

Remediation

Users are advised to update the Backup and Staging by WP Time Capsule plugin to version 1.22.27 or a newer patched version.