PLUGIN SECURITY
WordPress backup, restore & migration in minutes. Clone or duplicate your site and test updates safely on a staging copy. 100% unit-tested.
wp-stagingbackupmoverestoretransferwordpress backup
7 known CVEs on file for WP STAGING WordPress Backup Plugin - Backup Duplicator & Migration. Reported between 2022 and 2024.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2024-3412 | WP STAGING – WordPress Backup, Restore, Migration & Clone [wp-staging] < 3.5.0 | Unrestricted Upload of File with Dangerous Type | Critical 9.1 | < 3.5.0 | 3.5.0 | 2024-05-28 | — |
| CVE-2024-4469 | WP STAGING – WordPress Backup, Restore, Migration & Clone [wp-staging] < 3.5.0 | Server-Side Request Forgery (SSRF) | High 7.5 | < 3.5.0 | 3.5.0 | 2024-05-10 | — |
| CVE-2024-3682 | WP STAGING – WordPress Backup, Restore, Migration & Clone [wp-staging] < 3.5.0 | Exposure of Sensitive Information to an Unauthorized Actor | Medium 5.3 | < 3.5.0 | 3.5.0 | 2024-04-25 | — |
| CVE-2024-2309 | WP STAGING – WordPress Backup, Restore, Migration & Clone [wp-staging] < 3.4.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 3.4.0 | 3.4.0 | 2024-03-27 | — |
| CVE-2023-7204 | WP STAGING – WordPress Backup, Restore, Migration & Clone [wp-staging] < 3.2.0 | Exposure of Sensitive Information to an Unauthorized Actor | High 7.5 | < 3.2.0 | 3.2.0 | 2024-01-29 | — |
| CVE-2023-6113 | WP STAGING – WordPress Backup, Restore, Migration & Clone [wp-staging] < 3.1.3 | Exposure of Sensitive Information to an Unauthorized Actor | High 7.5 | < 3.1.3 | 3.1.3 | 2023-12-06 | — |
| CVE-2022-2737 | WP STAGING – WordPress Backup, Restore, Migration & Clone [wp-staging] < 2.9.18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 2.9.18 | 2.9.18 | 2022-08-17 | — |
The WP STAGING WordPress Backup Plugin – Migration Backup Restore plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wpstg_processing AJAX action in all versions up to, and including, 3.4.3. This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Source: CVE.org
The WP STAGING WordPress Backup Plugin – Migration Backup Restore plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.3. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.
Source: Wordfence
The WP STAGING and WP STAGING Pro plugins for WordPress are vulnerable to Sensitive Information Exposure in versions up to, and including, 3.4.3, and versions up to, and including, 5.4.3, respectively, via the ajaxSendReport function. This makes it possible for unauthenticated attackers to extract sensitive data from a log file, including system information and (in the Pro version) license keys. Successful exploitation requires an administrator to have used the 'Contact Us' functionality along with the "Enable this option to automatically submit the log files." option.
Source: CVE.org
The WP Staging (Free <= 3.3.3, Pro <= 5.3.3) plugins for WordPress are vulnerable to Stored Cross-Site Scripting via admin settings in various versions due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Source: Wordfence
Update the WordPress WP STAGING – Backup Duplicator & Migration plugin to the latest available version (at least 3.2.0). Dmitrii Ignatyev discovered and reported this Sensitive Data Exposure vulnerability in WordPress WP STAGING – Backup Duplicator & Migration Plugin. This vulnerability has been fixed in version 3.2.0. Have additional information or questions about this entry? Get in touch.
Source: Patchstack
The WP STAGING WordPress Backup Plugin Free and Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in various versions via the jobCache_backup_job file. This makes it possible for unauthenticated attackers to extract sensitive data such as the key which enables them to download the backups later.
Source: Wordfence
The WP STAGING plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.9.17 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Source: Wordfence
Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.