What is CVE-2020-8771?

CVE-2020-8771 is a vulnerability in N/a. Published 2020-02-06.

Is CVE-2020-8771 known to be exploited?

8 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in N/a

CVE-2020-8771

The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWP_JSON_PREFIX causes the client to be logged in as the first account on the list of administrator accounts.

EPSS: 0.892 (99.6th percentile) — read the EPSS interpretation.

Affected products

N/a — versions n/a

Public proof-of-concept exploits

20142995/nuclei-templates
ARPSyndicate/cvemon
ARPSyndicate/kenzer-templates
HycCodeQL/wordpress
Irdinaaaa/pentest
beardcodes/wordpress
ehsandeep/wordpress-application
vavkamil/dvwp

References

wpvulndb.com/vulnerabilities/10010 (x_refsource_MISC)
www.webarxsecurity.com/vulnerability-infinitewp-client-wp-time-capsule/ (x_refsource_MISC)

Frequently asked questions

What is CVE-2020-8771?: CVE-2020-8771 is a vulnerability in N/a. Published 2020-02-06.
Is CVE-2020-8771 known to be exploited?: 8 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.