WP STAGING Pro WordPress Backup Plugin

WP STAGING Pro WordPress Backup Plugin has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2025; all 5 are fixed as of September 2026. Their average CVSS score is 5.6, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 1 high. 2024 was the busiest year with 3 disclosures.

The most common weakness is Exposure Of Sensitive Information To An Unauthorized Actor, behind 3 of the records (60%). Other recurring categories include Cross-Site Request Forgery (CSRF), Cross-Site Scripting.

Every one of the 5 issues recorded for WP STAGING Pro WordPress Backup Plugin has a vendor fix available, so running the current release closes all known holes.

3 independent researchers contributed these findings, most of them (2) reported by Dmitrii Ignatyev.

Strategic Overview

Avg CVSSMedium

5.6/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all WP STAGING Pro WordPress Backup Plugin vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.5CVE-2024-5551

WP STAGING PRO - Backup Duplicator & Migration <= 5.6.0 - Cross-Site Request Forgery to Limited Local File Inclusion

Read the full analysis

Vulnerability Records

5 records


2025-04-15 19:52	WP Staging Pro <= 6.1.2 - Unauthenticated Information Exposure via getOutdatedPluginsRequest Function WP STAGING Pro WordPress Backup Plugin <= 6.1.2	`CVE-2025-3104`	5.3 Medium	haidv35	Yes
2024-06-13 00:00	WP STAGING PRO - Backup Duplicator & Migration <= 5.6.0 - Cross-Site Request Forgery to Limited Local File Inclusion WP STAGING Pro WordPress Backup Plugin <= 5.6.0	`CVE-2024-5551`	7.5 High	stealthcopter	Yes
2024-04-25 00:00	WP STAGING <= 3.4.3 and WP STAGING Pro <= 5.4.3 - Sensitive Information Exposure via Log File WP STAGING Pro WordPress Backup Plugin <= 5.4.3	`CVE-2024-3682`	5.3 Medium	haidv35	Yes
2024-03-27 00:00	WP Staging (Free <= 3.3.3, Pro <= 5.3.3) - Authenticated (Administrator+) Stored Cross-Site-Scripting WP STAGING Pro WordPress Backup Plugin <= 5.3.3	`CVE-2024-2309`	4.4 Medium	Dmitrii Ignatyev	Yes
2023-12-06 00:00	WP STAGING WordPress Backup Plugin Free <= 3.1.2 and Pro <= 5.1.2 - Sensitive Information Exposure WP STAGING Pro WordPress Backup Plugin < 5.1.3	`CVE-2023-6113`	5.3 Medium	Dmitrii Ignatyev	Yes

Showing 1–5 of 5 reports