{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-115871", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-10-23T18:33:00.912Z", "datePublished": "2026-11-13T09:35:10.951Z", "dateUpdated": "2026-11-13T09:35:10.951Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-11-13T09:35:10.951Z"}, "affected": [{"vendor": "renehermi", "product": "WP STAGING \u2013 Backups & Restore, Migration & Clone Plugin \u2013 Cloud Backups, Scheduled Backups", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.19.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP STAGING \u2013 Backups & Restore, Migration & Clone Plugin \u2013 Cloud Backups, Scheduled Backups plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 4.19.0. This is due to insufficient path validation in the `cleanStagingDirectory` function, where the `deleteDir` parameter is only stripped of whitespace and double slashes by `sanitizePath()` without removing `..` traversal sequences or enforcing containment within the staging directory, leaving the sole pre-deletion guard as a simple string equality check against the WordPress home path. This makes it possible for authenticated attackers, with administrator-level access and above, to recursively delete arbitrary directories on the server \u2014 including `wp-content`, `wp-admin`, or directories outside the WordPress installation on shared hosting \u2014 resulting in denial of service or permanent data loss. An attacker must sequence a clone start, cancellation, and restart to drive the `delete_job` cache into the `directory` step before re-cancelling with a manipulated `deleteDir` value supplied via the `wp_ajax_wpstg_cancel_clone` endpoint."}], "title": "WP STAGING <= 4.19.0 - Authenticated (Administrator+) Arbitrary Directory Deletion via 'deleteDir' Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0bfa1392-375a-4be2-ad4d-2c9d5fe3267c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Backend/Modules/Jobs/Delete.php#L630"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Backend/Modules/Jobs/Delete.php#L95"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Backend/Modules/Jobs/Delete.php#L547"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Backend/Administrator.php#L980"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Framework/Utils/Sanitize.php#L165"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Framework/Filesystem/Filesystem.php#L416"}, {"url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3787297%40wp-staging&new=3787297%40wp-staging"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-73 External Control of File Name or Path", "cweId": "CWE-73", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "baseScore": 2.7, "baseSeverity": "LOW"}}], "credits": [{"lang": "en", "type": "finder", "value": "Wordfence PRISM"}], "timeline": [{"time": "2026-11-12T21:00:20.000Z", "lang": "en", "value": "Disclosed"}]}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WP STAGING \u2013 Backups & Restore, Migration & Clone Plugin \u2013 Cloud Backups, Scheduled Backups", "vendor": "renehermi", "versions": [{"lessThanOrEqual": "4.19.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP STAGING \u2013 Backups & Restore, Migration & Clone Plugin \u2013 Cloud Backups, Scheduled Backups plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 4.19.0. This is due to insufficient path validation in the `cleanStagingDirectory` function, where the `deleteDir` parameter is only stripped of whitespace and double slashes by `sanitizePath()` without removing `..` traversal sequences or enforcing containment within the staging directory, leaving the sole pre-deletion guard as a simple string equality check against the WordPress home path. This makes it possible for authenticated attackers, with administrator-level access and above, to recursively delete arbitrary directories on the server \u2014 including `wp-content`, `wp-admin`, or directories outside the WordPress installation on shared hosting \u2014 resulting in denial of service or permanent data loss. An attacker must sequence a clone start, cancellation, and restart to drive the `delete_job` cache into the `directory` step before re-cancelling with a manipulated `deleteDir` value supplied via the `wp_ajax_wpstg_cancel_clone` endpoint."}], "id": "CVE-2026-115871", "lastModified": "2026-11-13T10:17:25.213", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2026-11-13T10:17:25.070", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Backend/Administrator.php#L980"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Backend/Modules/Jobs/Delete.php#L547"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Backend/Modules/Jobs/Delete.php#L630"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Backend/Modules/Jobs/Delete.php#L95"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Framework/Filesystem/Filesystem.php#L416"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Framework/Utils/Sanitize.php#L165"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3787297%40wp-staging&new=3787297%40wp-staging"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0bfa1392-375a-4be2-ad4d-2c9d5fe3267c?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-73"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{}