CVE-2020-37255: WordPress Time Capsule Auth Bypass Flaw

CVE-2020-37255 Overview

CVE-2020-37255 is an authentication bypass vulnerability in the WordPress Time Capsule Plugin version 1.21.16. The flaw allows unauthenticated remote attackers to obtain WordPress administrator privileges by sending a crafted HTTP POST request containing the IWP_JSON_PREFIX header. Successful exploitation returns a valid administrator session cookie, granting full access to the WordPress dashboard without supplying credentials. The vulnerability maps to [CWE-288: Authentication Bypass Using an Alternate Path or Channel] and carries a CVSS 4.0 score of 8.7.

Critical Impact
Unauthenticated attackers can obtain administrator session cookies and gain full control of the WordPress site over the network without user interaction.

Affected Products

WordPress Time Capsule Plugin version 1.21.16
WordPress installations using the affected plugin version
Sites exposing /wp-admin or plugin endpoints to the public internet

Discovery Timeline

2026-06-20 - CVE-2020-37255 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2020-37255

Vulnerability Analysis

The WordPress Time Capsule Plugin exposes a JSON-based management endpoint used for backup and restore operations. The plugin inspects incoming requests for the IWP_JSON_PREFIX header. When this header is present, the plugin treats the request as originating from a trusted management context and skips standard WordPress authentication checks.

An attacker who sends a POST request containing this header to the plugin endpoint receives a response that includes a valid administrator session cookie. The attacker can then attach the cookie to subsequent requests to /wp-admin and operate as a logged-in administrator. Public exploitation details for this flaw are documented in Exploit-DB #47941 and the VulnCheck WordPress Advisory.

Root Cause

The plugin uses the presence of a request header as an authentication signal rather than validating a cryptographic token, signed nonce, or user credential. This represents an alternate authentication path that bypasses the WordPress wp_authenticate flow, matching the pattern described in [CWE-288].

Attack Vector

Exploitation requires only network access to the target WordPress site. The attacker issues an HTTP POST request to a plugin endpoint and includes the IWP_JSON_PREFIX header. The plugin returns serialized administrator session data, which the attacker imports into a browser or HTTP client to access privileged WordPress functionality such as theme editing, plugin installation, and user management.

No verified exploit code is reproduced here. Public proof-of-concept details are available through Exploit-DB and the VulnCheck advisory referenced above.

Detection Methods for CVE-2020-37255

Indicators of Compromise

HTTP requests to the WordPress Time Capsule plugin endpoints containing the IWP_JSON_PREFIX header from untrusted source IPs.
Unexpected administrator login events in WordPress audit logs without corresponding wp-login.php activity.
Newly created administrator accounts, modified wp_users rows, or unauthorized plugin and theme installations.
Outbound connections from the web server to attacker-controlled infrastructure following plugin endpoint activity.

Detection Strategies

Inspect web server access logs for POST requests referencing Time Capsule plugin paths combined with the IWP_JSON_PREFIX header.
Alert on WordPress sessions where an administrator cookie appears without a preceding successful authentication event.
Correlate plugin endpoint activity with subsequent privileged actions in /wp-admin to identify session abuse.

Monitoring Recommendations

Enable verbose WordPress audit logging covering authentication, user creation, and plugin or theme changes.
Forward web server and WordPress logs to a centralized analytics platform for long-term retention and correlation.
Monitor file integrity on wp-content/plugins and wp-content/themes to detect post-compromise modifications.

How to Mitigate CVE-2020-37255

Immediate Actions Required

Update the WordPress Time Capsule Plugin to a version later than 1.21.16 that addresses the authentication bypass.
Rotate all WordPress administrator passwords and invalidate existing sessions by changing the WordPress secret keys in wp-config.php.
Audit user accounts and remove any unauthorized administrators, then review installed plugins and themes for unexpected additions.
Restrict access to plugin management endpoints using a web application firewall or IP allowlisting.

Patch Information

Review the vendor site at WP Time Capsule Overview for the latest plugin release and changelog. Apply the most recent fixed version through the WordPress plugin manager and verify the version string in wp-content/plugins/wp-time-capsule after the update.

Workarounds

Deactivate and delete the WP Time Capsule plugin if an updated version cannot be installed immediately.
Configure a web application firewall rule to block inbound HTTP requests containing the IWP_JSON_PREFIX header.
Restrict access to WordPress administrative paths to known management IP ranges using server-level access controls.

bash

# Example NGINX rule to block requests carrying the vulnerable header
if ($http_iwp_json_prefix) {
    return 403;
}