{
 "id": "WPSEC-2026-1259",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1259/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1259/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1259/index.md",
 "title": "WP STAGING WordPress Backup Plugin – Migration Backup Restore <= 4.17.0 - Unauthenticated Staging Site Login Protection Bypass via 'rest_route' Parameter",
 "description": "The WP STAGING plugin for WordPress is vulnerable to Authentication Bypass via the staging site login protection in all versions up to, and including, 4.17.0, due to the login check exempting every request that carries a non-empty 'rest_route' query parameter or whose path merely begins with the REST API prefix, even when WordPress does not actually serve a REST request. This makes it possible for unauthenticated attackers to reach parts of a protected staging site that should require a login, such as wp-comments-post.php and xmlrpc.php. On sites where the REST API handler has been disabled, they can also view the staging site's front-end pages.",
 "plugin": {
  "slug": "wp-staging",
  "name": "WP STAGING WordPress Backup Plugin – Migration Backup Restore",
  "full_name": "WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups",
  "wordpress_org": "https://wordpress.org/plugins/wp-staging/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-staging/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-staging"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-288"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.18.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.18.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.18.0",
 "remediation": "Update to 4.18.0 or later.",
 "fix_released": "2026-10-18T22:50:00+00:00",
 "published": "2026-10-20T10:08:26+00:00",
 "updated": "2026-10-20T09:12:42.868364+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1259/",
  "https://plugins.svn.wordpress.org/wp-staging/tags/4.18.0/",
  "https://wordpress.org/plugins/wp-staging/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-staging",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-20"
 }
}