The vulnerability identified as CVE-2026-42760 affects the Backup and Staging by WP Time Capsule plugin by revmakx, allowing authentication bypass through an alternate path or channel related to password recovery functionality. This enables an attacker to bypass normal authentication controls without requiring privileges or user interaction. The issue affects all versions up to 1.22.25. The CVSS 3.1 score of 7.5 reflects a high-severity risk with a network attack vector and significant confidentiality impact. No vendor advisory or patch information is currently available, and no exploits have been observed in the wild.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to bypass authentication and gain unauthorized access to sensitive data protected by the plugin. The confidentiality of data is impacted, but integrity and availability remain unaffected. This could lead to unauthorized disclosure of backup or staging data managed by the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific temporary mitigations or workarounds are provided in the available data.