Is WP STAGING PRO - Backup Duplicator & Migration safe?

What this plugin does

• Slug: wp-staging-pro
• Author: Syed Balkhi
• 1000000+ active installs
• 98/100 rating (4915 reviews on wordpress.org)
• 54094263 all-time downloads
• On WordPress.org since 2011-06-07

backupcloud backupdatabase backupmigrationwordpress backup

Maintenance status

• Last updated: 2026-05-22 9:05pm GMT
• Tested up to WordPress: 7.0.2
• Requires PHP: 7.4+

Known vulnerabilities

5 known CVEs on file for WP STAGING PRO - Backup Duplicator & Migration.

CVE-2024-5551

The WP STAGING Pro WordPress Backup Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.6.0. This is due to missing or incorrect nonce validation on the 'sub' parameter called from the WP STAGING WordPress Backup Plugin - Backup Duplicator & Migration plugin. This makes it possible for unauthenticated attackers to include any local files that end in '-settings.php' via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Source: CVE.org

CVE-2024-3682

The WP STAGING and WP STAGING Pro plugins for WordPress are vulnerable to Sensitive Information Exposure in versions up to, and including, 3.4.3, and versions up to, and including, 5.4.3, respectively, via the ajaxSendReport function. This makes it possible for unauthenticated attackers to extract sensitive data from a log file, including system information and (in the Pro version) license keys. Successful exploitation requires an administrator to have used the 'Contact Us' functionality along with the "Enable this option to automatically submit the log files." option.

Source: CVE.org

CVE-2024-2309

The WP Staging (Free <= 3.3.3, Pro <= 5.3.3) plugins for WordPress are vulnerable to Stored Cross-Site Scripting via admin settings in various versions due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Source: Wordfence

CVE-2023-6113

The WP STAGING WordPress Backup Plugin Free and Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in various versions via the jobCache_backup_job file. This makes it possible for unauthenticated attackers to extract sensitive data such as the key which enables them to download the backups later.

Source: Wordfence

CVE-2025-3104

The WP STAGING Pro WordPress Backup Plugin for WordPress is vulnerable to Information Exposure in all versions up to and including 6.1.2 due to missing capability checks on the getOutdatedPluginsRequest() function. This makes it possible for unauthenticated attackers to reveal outdated installed active or inactive plugins.

Source: Wordfence

How to fix it

Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.

This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.

Safer / more established alternatives

• All-in-One WP Migration and Backup — 5000000+ active installs — 90/100 (7655) — max PHP <8.0
• UpdraftPlus: WP Backup & Migration Plugin — 3000000+ active installs — 96/100 (8583) — max PHP <8.0
• Jetpack – WP Security, Backup, Speed, & Growth — 3000000+ active installs — 76/100 (2404)
• ManageWP Worker — 1000000+ active installs — 92/100 (677) — max PHP <8.0
• WPvivid — Backup, Migration & Staging — 900000+ active installs — 98/100 (1514) — max PHP <8.0