WP STAGING WordPress Backup Plugin – Migration Backup Restore <= 4.19.0 - Authenticated (Administrator+) Arbitrary Directory Deletion via 'deleteDir' Parameter
- ID
- WPSEC-2026-2694
- Plugin
- WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups (wp-staging)
- Affected
- all versions before 4.20.0
- Remediation
- Update to 4.20.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
- Weakness
- CWE-22
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-07
- Attack surface
- WP STAGING WordPress Backup Plugin – Migration Backup Restore on WPSec AttackSurface
- Fix released
- Published
Description
The WP STAGING plugin for WordPress is vulnerable to arbitrary directory deletion via the 'deleteDir' parameter of the staging site delete job in all versions up to, and including, 4.19.0 due to insufficient path validation in the legacy clone-cancellation job (wpstg_cancel_clone), as the only safeguard refused the WordPress home path. This makes it possible for authenticated attackers with administrator-level access on a single site of a multisite network, who cannot otherwise touch files shared by the network, to recursively delete arbitrary directories that the web server can write to, such as the network's plugins or themes folder or other sites' uploads. On a single-site installation an administrator gains nothing from this.
References
- https://wpsec.com/vuln/WPSEC-2026-2694/
- https://plugins.svn.wordpress.org/wp-staging/tags/4.20.0/
- https://wordpress.org/plugins/wp-staging/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS