# WP STAGING WordPress Backup Plugin – Migration Backup Restore <= 4.17.0 - Unauthenticated Staging Site Login Protection Bypass via 'rest_route' Parameter

- **ID:** WPSEC-2026-1259
- **Plugin:** WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups (`wp-staging`), https://wordpress.org/plugins/wp-staging/
- **Affected versions:** all versions before 4.18.0
- **Fixed in:** 4.18.0 (Update to 4.18.0 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-288
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-20)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-staging
- **Fix released:** 2026-10-18
- **Published:** 2026-10-20
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1259/

## Description

The WP STAGING plugin for WordPress is vulnerable to Authentication Bypass via the staging site login protection in all versions up to, and including, 4.17.0, due to the login check exempting every request that carries a non-empty 'rest_route' query parameter or whose path merely begins with the REST API prefix, even when WordPress does not actually serve a REST request. This makes it possible for unauthenticated attackers to reach parts of a protected staging site that should require a login, such as wp-comments-post.php and xmlrpc.php. On sites where the REST API handler has been disabled, they can also view the staging site's front-end pages.

## References

- https://wpsec.com/vuln/WPSEC-2026-1259/
- https://plugins.svn.wordpress.org/wp-staging/tags/4.18.0/
- https://wordpress.org/plugins/wp-staging/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1259/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.