¿Es seguro WP STAGING PRO - Backup Duplicator & Migration?

Qué hace este plugin

• Slug: wp-staging-pro
• Autor: Syed Balkhi
• 1000000+ instalaciones activas
• 98/100 calificación (4915 reseñas en wordpress.org)
• 54094263 descargas totales
• En WordPress.org desde 2011-06-07

backupcloud backupdatabase backupmigrationwordpress backup

Estado de mantenimiento

• Última actualización: 2026-05-22 9:05pm GMT
• Probado hasta WordPress: 7.0.2
• Requiere PHP: 7.4+

Vulnerabilidades conocidas

5 CVEs conocidos registrados para WP STAGING PRO - Backup Duplicator & Migration.

CVE-2024-5551

The WP STAGING Pro WordPress Backup Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.6.0. This is due to missing or incorrect nonce validation on the 'sub' parameter called from the WP STAGING WordPress Backup Plugin - Backup Duplicator & Migration plugin. This makes it possible for unauthenticated attackers to include any local files that end in '-settings.php' via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-3682

The WP STAGING and WP STAGING Pro plugins for WordPress are vulnerable to Sensitive Information Exposure in versions up to, and including, 3.4.3, and versions up to, and including, 5.4.3, respectively, via the ajaxSendReport function. This makes it possible for unauthenticated attackers to extract sensitive data from a log file, including system information and (in the Pro version) license keys. Successful exploitation requires an administrator to have used the 'Contact Us' functionality along with the "Enable this option to automatically submit the log files." option.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-2309

The WP Staging (Free <= 3.3.3, Pro <= 5.3.3) plugins for WordPress are vulnerable to Stored Cross-Site Scripting via admin settings in various versions due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2023-6113

The WP STAGING WordPress Backup Plugin Free and Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in various versions via the jobCache_backup_job file. This makes it possible for unauthenticated attackers to extract sensitive data such as the key which enables them to download the backups later.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-3104

The WP STAGING Pro WordPress Backup Plugin for WordPress is vulnerable to Information Exposure in all versions up to and including 6.1.2 due to missing capability checks on the getOutdatedPluginsRequest() function. This makes it possible for unauthenticated attackers to reveal outdated installed active or inactive plugins.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Cómo solucionarlo

Actualiza este plugin a la última versión de wordpress.org — cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en") cuando hay una registrada.

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• All-in-One WP Migration and Backup — 5000000+ instalaciones activas — 90/100 (7655) — PHP máx. <8.0
• UpdraftPlus: WP Backup & Migration Plugin — 3000000+ instalaciones activas — 96/100 (8583) — PHP máx. <8.0
• Jetpack – WP Security, Backup, Speed, & Growth — 3000000+ instalaciones activas — 76/100 (2404)
• ManageWP Worker — 1000000+ instalaciones activas — 92/100 (677) — PHP máx. <8.0
• WPvivid — Backup, Migration & Staging — 900000+ instalaciones activas — 98/100 (1514) — PHP máx. <8.0