WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups
WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups has 7 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2024; all 7 are fixed as of September 2026. Their average CVSS score is 5.7, and the most serious one scores 9.1 out of 10. Severity breakdown: 1 critical and 0 high. 2024 was the busiest year with 5 disclosures.
The most common weakness is Exposure Of Sensitive Information To An Unauthorized Actor, behind 3 of the records (43%). Other recurring categories include Cross-Site Scripting, Server-Side Request Forgery (SSRF).
Every one of the 7 issues recorded for WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups has a vendor fix available, so running the current release closes all known holes.
3 independent researchers contributed these findings, most of them (4) reported by Dmitrii Ignatyev. WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups is installed on roughly 100,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2024-3412WP STAGING WordPress Backup Plugin – Migration Backup Restore <= 3.4.3 - Authenticated (Admin+) Arbitrary File Upload
Read the full analysisVulnerability Records

WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups
Author
Rene Hermenau
WordPress Backup, Restore, Staging, Cloning & Migration — All in One WP STAGING is the all-in-one WordPress backup, restore, staging, cloning, and migration plugin, built for professional workflows with 100% unit-tested code, thousands of automated tests, and extensive end-to-end testing across supported PHP versions. Create a full backup or an exact clone or copy of your website in minutes. Use it to duplicate your site, test plugin and theme updates safely, restore your site when needed, move or migrate WordPress to another server, transfer your site to a new host, or build a staging copy before making changes. WP STAGING also works as a WordPress duplicator, so you do not need a separate duplicator plugin to copy your website. WP STAGING reliably backs up, clones, and migrates WooCommerce stores too, including orders, products, and customer data. WP STAGING is developed in Germany and designed for agencies, developers, and businesses that need reliable WordPress backup, recovery, staging, restore, and migration workflows. WP STAGING | PRO also includes advanced workflows such as Remote Sync, which lets you pull a WordPress site securely from one server to another using an API key, and WP STAGING CLI, which can turn a WP STAGING backup into a local Docker-based development site. All data stays on your server unless you choose a transfer or remote storage workflow. WP STAGING is designed for speed, reliability, and low-resource environments, including shared hosting. WP STAGING automatically performs search and replace for links and paths during cloning, backup, restore, and migration workflows. This staging and backup plugin can clone your website quickly and efficiently, even if it is running on a weak shared hosting server. WP STAGING FREE – BACKUP & STAGING FEATURES Clone the entire production site into a subdirectory like example.com/staging-site. High-performance backup and cloning, even for websites with very large databases. Create full or partial backups — full-site backup, database-only, or files-only backups. Scheduled backups with automatic daily backups. Easy to use: create a clone or backup in one click. Efficient background processing without slowing down your website. No Software as a Service and no external account required. All your data stays on your server. Your data belongs to you only. No server timeouts on huge websites or weak servers. Fast backup, clone, and restore workflows depending on site size and server resources. Use the clone as part of your backup and update strategy. Only administrators can access the cloned or backup website. SEO-friendly staging sites with login protection and no-index handling. The admin bar on the staging / backup website is orange colored and shows when you work on the staging site. Extensive logging features. Supports Apache, Nginx, Microsoft IIS, and LiteSpeed Server. Every release passes extensive automated tests to keep the plugin robust, reliable, and fast. Fast and professional support team. WP STAGING | PRO – BACKUP & STAGING FEATURES The features below are available in WP STAGING | PRO. Remote Sync – Pull a WordPress site securely from one server to another. WP STAGING CLI – Turn a backup into a local Docker-based development site. Migrate and transfer WordPress to another host or domain. Push staging changes to production (staging to live), including plugins, themes, and media files, with one click. Clone a backup or staging site to a separate database. Choose a custom directory for a backup or cloned site. Select a custom subdomain destination like dev.example.com. Define user roles for accessing the clone or backup site. This can be clients or external developers. Multisite support for migration, backup, and cloning. Schedule recurring backups by time and interval. Download and upload backups to another server for migration and transfer. Backup retention settings. Custom backup names. Email notifications if a backup cannot be created. WordPress multisite backup and restore. Cloud backup, offsite backup, and remote backups to external storage providers. Backup to Google Drive. Backup to Amazon S3. Backup to (S)FTP. Backup to Dropbox. Custom backup folder destinations for cloud storage providers. Priority support. DOCUMENTATION How to Backup and Restore WordPress Backup and Restore WordPress Backup & Transfer WordPress Site to Another Host How to Migrate Your WordPress Site to a New Host Remote Sync Pull a WordPress Site from One Server to Another Local Docker Development with WP STAGING CLI WP STAGING CLI – Upgrade Now All Backup Guides All Backup Guides Working with Staging Sites Working with Staging Sites FAQ for Backup & Cloning FAQ for Backup & Cloning Troubleshooting Backup & Cloning Troubleshooting Backup & Cloning WP STAGING BACKUP & CLONING TECHNICAL REQUIREMENTS & INFORMATION Works on latest version of WordPress Minimum Supported WordPress Version 3.8 Cloning and Backup work on all webhosts No extra libraries required Backup & cloning supports huge websites Custom backup format is much faster and smaller than any tar or zip compression Backup & cloning works in low memory & shared hosting environments SUPPORT WP STAGING Backup & Cloning
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C