CVE-2026-8996 is a missing authorization vulnerability in the Backup and Staging by WP Time Capsule WordPress plugin. It allows authenticated users with low privileges (subscriber-level and above) to access and download the most recent admin-decrypted SQL database backup file through the download_recent_decrypted_file_wptc functionality. This file typically contains sensitive data including password hashes and user credentials stored in the 'recent_decrypted_file' option. The vulnerability exists in all plugin versions up to and including 1.22.26. Exploitation depends on a prior decrypt action performed by an administrator, which creates the decrypted backup file in the plugin's upload directory. There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

An attacker with subscriber-level or higher access can obtain sensitive information from the decrypted SQL backup file, including password hashes and user credentials. This exposure can lead to further compromise of the WordPress site or user accounts. The vulnerability does not affect availability or integrity but has a high confidentiality impact. Exploitation requires prior administrative action to decrypt a backup, so the risk is conditional on that prerequisite.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level access to trusted users only and monitor for any unauthorized access. Administrators should avoid decrypting backups unless necessary and remove decrypted backup files promptly after use.