cve/2020/CVE-2020-8771.md

CVE-2020-8771

Description

The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWP_JSON_PREFIX causes the client to be logged in as the first account on the list of administrator accounts.

POC

Reference

• https://wpvulndb.com/vulnerabilities/10010
• https://wpvulndb.com/vulnerabilities/10010

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/ARPSyndicate/kenzer-templates
• https://github.com/HycCodeQL/wordpress
• https://github.com/Irdinaaaa/pentest
• https://github.com/beardcodes/wordpress
• https://github.com/ehsandeep/wordpress-application
• https://github.com/vavkamil/dvwp