High severity7.5NVD Advisory· Published Jun 20, 2026· Updated Jun 23, 2026

CVE-2020-37255

Description

WordPress Time Capsule Plugin 1.21.16 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain administrative access by sending a crafted POST request with the IWP_JSON_PREFIX header. Attackers can exploit this flaw to obtain valid administrator session cookies and access the WordPress dashboard without providing credentials.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Time Capsule Pluginllm-create
Range: <1.21.16
WordPress/Wp Time Capsuleinferred
Range: = 1.21.16
Package: https://wordpress.org/plugins/wp-time-capsule

Patches

Vulnerability mechanics

References

wptimecapsule.comnvd
www.exploit-db.com/exploits/47941nvd
www.vulncheck.com/advisories/wordpress-time-capsule-plugin-authentication-bypassnvd

News mentions

25 WordPress Plugin CVEs Drop in Three Days: File Deletion, SSRF, and XSS Dominate the Batch
Vypr Intelligence · Jun 22, 2026

cvss	0.488
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000