WordPress plugin
WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 8 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical1
- High0
- Medium6
- Low1
All WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Low2.7 | Authenticated (Administrator+) Arbitrary Directory Deletion via 'deleteDir' Parameter ≤4.19.0Update to 4.20.0 | CVE-2026-115871 | |
| Critical9.1 | Authenticated (Admin+) Arbitrary File Upload ≤3.4.3Update to 3.5.0 | CVE-2024-3412 | |
| Medium4.7 | Authenticated (Administrator+) Server-Side Request Forgery ≤3.4.3Update to 3.5.0 | CVE-2024-4469 | |
| Medium5.3 | Sensitive Information Exposure via Log File ≤3.4.3Update to 3.5.0 | CVE-2024-3682 | |
| Medium4.4 | Authenticated (Administrator+) Stored Cross-Site-Scripting ≤3.3.3Update to 3.4.0 | CVE-2024-2309 | |
| Medium5.3 | Sensitive Information Exposure via cache files <3.2.0Update to 3.2.0 | CVE-2023-7204 | |
| Medium5.3 | Sensitive Information Exposure <3.1.3Update to 3.1.3 | CVE-2023-6113 | |
| Medium5.5 | Authenticated (Administrator+) Stored Cross-Site Scripting ≤2.9.17Update to 2.9.18 | CVE-2022-2737 |
- Low2.7Authenticated (Administrator+) Arbitrary Directory Deletion via 'deleteDir' Parameter
≤4.19.0Update to 4.20.0
- Critical9.1Authenticated (Admin+) Arbitrary File Upload
≤3.4.3Update to 3.5.0
- Medium4.7Authenticated (Administrator+) Server-Side Request Forgery
≤3.4.3Update to 3.5.0
- Medium5.3Sensitive Information Exposure via Log File
≤3.4.3Update to 3.5.0
- Medium4.4Authenticated (Administrator+) Stored Cross-Site-Scripting
≤3.3.3Update to 3.4.0
- Medium5.3Sensitive Information Exposure via cache files
<3.2.0Update to 3.2.0
- Medium5.3Sensitive Information Exposure
<3.1.3Update to 3.1.3
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
≤2.9.17Update to 2.9.18
WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups: common questions
Does WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups have known vulnerabilities?
Yes. VulnCrest Radar lists 8 known vulnerabilities in WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups: 1 critical, 6 medium, 1 low. None are known to affect version null.
How do I check which version of WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups vulnerability?
CVE-2026-115871, published Nov 12, 2026: WP STAGING <= 4.19.0 - Authenticated (Administrator+) Arbitrary Directory Deletion via 'deleteDir' Parameter. Severity: Low (CVSS 2.7).
Is any WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups vulnerability listed in CISA KEV?
No. None of the known WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups vulnerabilities is currently listed in the CISA KEV catalog.