The vulnerability exists in the Backup and Staging by WP Time Capsule WordPress plugin versions older than 1.22.28. The plugin’s handler that pushes a staging site to the live environment does not verify that the caller has the necessary capability or a valid nonce. As a result, any user logged in with a Subscriber role on a staging site can trigger the deployment, which overwrites the live site’s database and configuration files, effectively taking the site offline and potentially compromising data integrity.

The affected product is the "Backup and Staging by WP Time Capsule" WordPress plugin when installed in any WordPress site using a version older than 1.22.28. The vulnerability is present on all WordPress installations with the plugin enabled and a staging site configured; it does not depend on any specific operating system or other components.

The lack of capability and nonce checks makes the flaw exploitable by any authenticated user with a Subscriber role. Because the action deletes the existing live database and configuration, an attacker can cause immediate downtime and permanent data loss. No CVSS score is published, and EPSS is not available, making the quantitative risk difficult to assess; however, the KEV database does not list this vulnerability, suggesting limited evidence of exploitation at this time. Still, the attack vector requires an existing authenticated subscriber account, which could be obtained by credential compromise or privilege abuse.