¿Es seguro WP STAGING WordPress Backup Plugin - Backup Duplicator & Migration?

Qué hace este plugin

• Slug: wp-staging
• Autor: Rene Hermenau
• 100000+ instalaciones activas
• 96/100 calificación (2462 reseñas en wordpress.org)
• 5661879 descargas totales
• En WordPress.org desde 2015-08-05

backupmoverestoretransferwordpress backup

Estado de mantenimiento

• Última actualización: 2026-07-15 8:40pm GMT
• Probado hasta WordPress: 7.0.2
• Requiere PHP: 7.0+
• PHP máximo soportado (analizado): <8.0

Vulnerabilidades conocidas

7 CVEs conocidos registrados para WP STAGING WordPress Backup Plugin - Backup Duplicator & Migration. Reportadas entre 2022 y 2024.

CVE-2024-3412

The WP STAGING WordPress Backup Plugin – Migration Backup Restore plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wpstg_processing AJAX action in all versions up to, and including, 3.4.3. This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-4469

The WP STAGING WordPress Backup Plugin – Migration Backup Restore plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.3. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-3682

The WP STAGING and WP STAGING Pro plugins for WordPress are vulnerable to Sensitive Information Exposure in versions up to, and including, 3.4.3, and versions up to, and including, 5.4.3, respectively, via the ajaxSendReport function. This makes it possible for unauthenticated attackers to extract sensitive data from a log file, including system information and (in the Pro version) license keys. Successful exploitation requires an administrator to have used the 'Contact Us' functionality along with the "Enable this option to automatically submit the log files." option.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-2309

The WP Staging (Free <= 3.3.3, Pro <= 5.3.3) plugins for WordPress are vulnerable to Stored Cross-Site Scripting via admin settings in various versions due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2023-7204

Update the WordPress WP STAGING – Backup Duplicator & Migration plugin to the latest available version (at least 3.2.0). Dmitrii Ignatyev discovered and reported this Sensitive Data Exposure vulnerability in WordPress WP STAGING – Backup Duplicator & Migration Plugin. This vulnerability has been fixed in version 3.2.0. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-6113

The WP STAGING WordPress Backup Plugin Free and Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in various versions via the jobCache_backup_job file. This makes it possible for unauthenticated attackers to extract sensitive data such as the key which enables them to download the backups later.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2022-2737

The WP STAGING plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.9.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Cómo solucionarlo

Actualiza este plugin a la última versión de wordpress.org — cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en") cuando hay una registrada.

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• All-in-One WP Migration and Backup — 5000000+ instalaciones activas — 90/100 (7655) — PHP máx. <8.0
• UpdraftPlus: WP Backup & Migration Plugin — 3000000+ instalaciones activas — 96/100 (8583) — PHP máx. <8.0
• Jetpack – WP Security, Backup, Speed, & Growth — 3000000+ instalaciones activas — 76/100 (2404)
• Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More — 1000000+ instalaciones activas — 98/100 (4915) — PHP máx. <8.0
• ManageWP Worker — 1000000+ instalaciones activas — 92/100 (677) — PHP máx. <8.0