Cross-Site Request Forgery Vulnerability in WordPress Backup Plugin

CVE-2024-5551

What is CVE-2024-5551?

The WP STAGING Pro WordPress Backup Plugin is affected by a Cross-Site Request Forgery vulnerability that allows unauthenticated attackers to exploit missing or incorrectly implemented nonce validation on the 'sub' parameter. This flaw enables attackers to manipulate site administrators into executing malicious requests, which can result in the exposure of local files ending in '-settings.php'. This vulnerability is present in all versions up to and including 5.6.0, posing significant risks for users relying on this backup solution.

References