CVE-2023-6113: The WP STAGING WordPress Backup Plugin before 3.1.3 and WP STAGING Pro WordPress Backup Plugin before 5.1.3 do not prevent visitors from leaking key information about ongoing backups processes, allowi

high Affects wp-staging (WordPress plugin). Feed 2026.10.29.4, updated 2026-10-29; published 2024-01-01; advisory modified 2026-06-17.

The WP STAGING WordPress Backup Plugin before 3.1.3 and WP STAGING Pro WordPress Backup Plugin before 5.1.3 do not prevent visitors from leaking key information about ongoing backups processes, allowi

Package: wp-staging (WordPress plugin) WordPress
Affected versions: <3.1.3
Fixed in: 3.1.3
Severity: high CVSS 7.5
Exploitation: not on CISA KEV · EPSS 1% (55.9th percentile)
Published: 2024-01-01
Source: nvd

References

NVD record wp-staging (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden wordpress /var/www/html

# or, without Composer
pipx install phpwarden   &&   phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2022-2737 medium The WP STAGING WordPress plugin before 2.9.18 does not sanitise and escape some of its set same package: wp-staging (WordPress plugin)
CVE-2023-7204 high The WP STAGING WordPress Backup plugin before 3.2.0 allows access to cache files during th same package: wp-staging (WordPress plugin)
CVE-2024-4469 high The WP STAGING WordPress Backup Plugin WordPress plugin before 3.5.0 does not prevent use same package: wp-staging (WordPress plugin)
CVE-2024-2309 medium The WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro Word same package: wp-staging (WordPress plugin)
CVE-2024-5551 high The WP STAGING Pro WordPress Backup Plugin plugin for WordPress is vulnerable to Cross-Sit same package: wp-staging (WordPress plugin)
CVE-2023-6553 critical The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all ve also from 2023