CVE-2020-8771

CVE-2020-8771 describes a critical authentication bypass vulnerability in the Time Capsule plugin for WordPress, affecting versions prior to 1.21.16. This flaw allows an unauthenticated attacker to gain administrative access by including a specific string (IWP_JSON_PREFIX) in any request, effectively logging them in as the first administrator account. With a CVSS score of 9.8 (Critical) and a FAUCET Risk Score of 100/100, this vulnerability poses a severe threat due to its network-based attack vector, low complexity, and complete compromise of confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, Nuclei templates exist for exploitation, and the vulnerability has garnered significant community discussion, indicating potential for active exploitation.