{
 "id": "WPSEC-2026-2694",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2694/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2694/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2694/index.md",
 "title": "WP STAGING WordPress Backup Plugin – Migration Backup Restore <= 4.19.0 - Authenticated (Administrator+) Arbitrary Directory Deletion via 'deleteDir' Parameter",
 "description": "The WP STAGING plugin for WordPress is vulnerable to arbitrary directory deletion via the 'deleteDir' parameter of the staging site delete job in all versions up to, and including, 4.19.0 due to insufficient path validation in the legacy clone-cancellation job (wpstg_cancel_clone), as the only safeguard refused the WordPress home path. This makes it possible for authenticated attackers with administrator-level access on a single site of a multisite network, who cannot otherwise touch files shared by the network, to recursively delete arbitrary directories that the web server can write to, such as the network's plugins or themes folder or other sites' uploads. On a single-site installation an administrator gains nothing from this.",
 "plugin": {
  "slug": "wp-staging",
  "name": "WP STAGING WordPress Backup Plugin – Migration Backup Restore",
  "full_name": "WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups",
  "wordpress_org": "https://wordpress.org/plugins/wp-staging/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-staging/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-staging"
 },
 "type": "FILE DELETION",
 "cwe": [
  "CWE-22"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.20.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.20.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.20.0",
 "remediation": "Update to 4.20.0 or later.",
 "fix_released": "2026-11-06T06:33:50+00:00",
 "published": "2026-11-07T06:40:50+00:00",
 "updated": "2026-11-06T12:04:28.637054+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2694/",
  "https://plugins.svn.wordpress.org/wp-staging/tags/4.20.0/",
  "https://wordpress.org/plugins/wp-staging/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-staging",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-07"
 }
}