# WP STAGING WordPress Backup Plugin – Migration Backup Restore <= 4.19.0 - Authenticated (Administrator+) Arbitrary Directory Deletion via 'deleteDir' Parameter

- **ID:** WPSEC-2026-2694
- **Plugin:** WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups (`wp-staging`), https://wordpress.org/plugins/wp-staging/
- **Affected versions:** all versions before 4.20.0
- **Fixed in:** 4.20.0 (Update to 4.20.0 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H)
- **Weakness:** CWE-22
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-07)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-staging
- **Fix released:** 2026-11-06
- **Published:** 2026-11-07
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2694/

## Description

The WP STAGING plugin for WordPress is vulnerable to arbitrary directory deletion via the 'deleteDir' parameter of the staging site delete job in all versions up to, and including, 4.19.0 due to insufficient path validation in the legacy clone-cancellation job (wpstg_cancel_clone), as the only safeguard refused the WordPress home path. This makes it possible for authenticated attackers with administrator-level access on a single site of a multisite network, who cannot otherwise touch files shared by the network, to recursively delete arbitrary directories that the web server can write to, such as the network's plugins or themes folder or other sites' uploads. On a single-site installation an administrator gains nothing from this.

## References

- https://wpsec.com/vuln/WPSEC-2026-2694/
- https://plugins.svn.wordpress.org/wp-staging/tags/4.20.0/
- https://wordpress.org/plugins/wp-staging/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2694/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.