| Package | Affected versions | Patched versions |
|---|---|---|
| wp time capsule | < 1.21.16 | 1.21.16 |
The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWP_JSON_PREFIX causes the client to be logged in as the first account on the list of administrator accounts.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free