Published October 21, 2026. Based on public reports available on that date; details may change.
CVE-2026-107237 affects Backup and Staging by WP Time Capsule versions before 1.22.28 because its staging-to-live deployment handler lacks capability and nonce checks. Update to version 1.22.28 or later, then review every account on connected staging sites and confirm the production site has not been overwritten unexpectedly.
What happened
The vulnerability is an authorization problem in the function that deploys a staging site to a live site. The published record says the affected plugin does not perform capability or nonce checks on that handler. Capabilities are WordPress permissions, and a nonce is a request token WordPress commonly uses to help verify an action.
The reported consequence is serious: a logged-in user with a Subscriber account on a WP Time Capsule staging site can overwrite the separate live site's database and configuration, taking the live site offline. The issue is not described as anonymous access. It depends on an authenticated Subscriber account on the connected staging environment.
Staging sites are often treated as less important because they are not customer-facing. This report is a useful reminder that staging can hold a route to production. When a tool can copy data and configuration from one environment to another, the accounts and plugin versions on both sides deserve production-level attention.
The cited records do not report exploitation in the wild. The fixed version is 1.22.28, so affected sites should update before running another staging-to-live deployment.
Who is affected
Backup and Staging by WP Time Capsule versions before 1.22.28 are affected. Version 1.22.28 is the fix. Check each staging site and live site that participates in a WP Time Capsule deployment relationship, because an old staging installation is central to the reported attack path.
In the WordPress dashboard, open Plugins and find Backup and Staging by WP Time Capsule. Record the installed version. With WP-CLI, wp plugin list lists the plugin name and version, which is useful when the exact directory slug is not obvious.
Next, list every WordPress user on each staging site. Pay close attention to Subscriber accounts, since the report identifies that role. Some staging copies retain production users, old test accounts, agency logins, or accounts created for demonstrations. Every one of those is relevant if the staging site remains connected to production.
How to check your site
The first check is version and account inventory. The second is whether any unexpected deployment or overwrite has already happened. Preserve evidence before making broad changes if you suspect one did.
- Confirm the WP Time Capsule version on the staging site and any related live site.
- Update any instance below 1.22.28 before initiating a deployment.
- In Users on each staging site, review all Subscriber accounts and remove accounts with no current owner or purpose.
- Review the plugin's staging and deployment configuration to identify which staging site is connected to which live site.
- Compare the live site's database-backed content and configuration with the expected current production state.
The last step should be practical rather than abstract. Check the home page, key posts or products, active theme settings, plugin settings, and administrator users. A production overwrite may show up as old content returning, settings changing, or the site becoming unavailable. Keep a written record of the expected production state and its most recent planned deployment.
If the site is offline, avoid making repeated deployment attempts to fix it. Preserve logs and copies of the current database and files, then work from a known-good recovery plan. The guidance in what to do in the first hour after a WordPress hack is also useful when you cannot yet tell whether an outage was malicious or accidental.
What to do now
Update Backup and Staging by WP Time Capsule to version 1.22.28 or later. Use the normal WordPress update screen or your established maintenance process, then verify the installed version. Do not rely on the live site alone being current when a staging site is the reported source of access.
Remove unnecessary staging accounts, especially Subscriber accounts. Assign each remaining account to a named person and use strong, unique credentials. If a staging site is no longer needed, take it out of service through your normal process rather than leaving it accessible with copied production users.
Restrict access to staging at the hosting or authentication layer where your environment supports it. This is not a substitute for the update, but it reduces the number of people who can reach the site. Keep separate staging and production credentials where possible, and avoid copying unnecessary personal or customer information into staging.
Review deployment permissions and document who is allowed to move a site to production. A WordPress security audit can help evaluate that workflow, including access controls, backups, and recovery steps. Regular checks from the WordPress maintenance plan checklist can keep staging systems from becoming forgotten production dependencies.
If you find an unauthorized account, unexpected production changes, or a deployment you cannot explain, preserve relevant logs before cleaning up. Rotate affected WordPress, hosting, SFTP, and database credentials as appropriate, and verify the live configuration against a known-good state. Do not assume that restoring the visible pages alone resolves an access problem.
When to get help
Get help if the live site was overwritten, staging accounts cannot be accounted for, or you need to confirm that an unauthorized deployment did not change data or configuration. WordPress malware removal can assist with a suspected compromise, and WordPress hardening can help rebuild a safer staging and deployment process.