WP STAGING WordPress Backup Plugin – Migration Backup Restore <= 4.17.0 - Unauthenticated Staging Site Login Protection Bypass via 'rest_route' Parameter
- ID
- WPSEC-2026-1259
- Plugin
- WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups (wp-staging)
- Affected
- all versions before 4.18.0
- Remediation
- Update to 4.18.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-288
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-20
- Attack surface
- WP STAGING WordPress Backup Plugin – Migration Backup Restore on WPSec AttackSurface
- Fix released
- Published
Description
The WP STAGING plugin for WordPress is vulnerable to Authentication Bypass via the staging site login protection in all versions up to, and including, 4.17.0, due to the login check exempting every request that carries a non-empty 'rest_route' query parameter or whose path merely begins with the REST API prefix, even when WordPress does not actually serve a REST request. This makes it possible for unauthenticated attackers to reach parts of a protected staging site that should require a login, such as wp-comments-post.php and xmlrpc.php. On sites where the REST API handler has been disabled, they can also view the staging site's front-end pages.
References
- https://wpsec.com/vuln/WPSEC-2026-1259/
- https://plugins.svn.wordpress.org/wp-staging/tags/4.18.0/
- https://wordpress.org/plugins/wp-staging/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS