CVE-2024-8856 is a critical vulnerability in the Backup and Staging by WP Time Capsule WordPress plugin caused by improper validation of uploaded files in UploadHandler.php and absence of direct file access restrictions. This flaw permits unauthenticated attackers to upload arbitrary files, potentially enabling remote code execution on the server hosting the vulnerable plugin. The vulnerability affects all versions up to 1.22.21. The CVSS 3.1 base score is 9.8, reflecting high impact on confidentiality, integrity, and availability with no required privileges or user interaction.

An attacker can upload arbitrary files without authentication, which may lead to remote code execution on the affected server. This compromises the confidentiality, integrity, and availability of the system running the vulnerable plugin. The critical CVSS score of 9.8 reflects the severity and ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the Backup and Staging by WP Time Capsule plugin to prevent exploitation. Monitor the vendor's communications for updates and apply patches promptly once available.