Cross-Site Request Forgery Vulnerability in WordPress Backup Plugin
CVE-2024-5551

8.8HIGH

Key Information:

Vendor
Wordpress
Status
WP Staging Pro WordPress Backup Plugin
Vendor
CVE Published:
14 June 2024

Summary

The WP STAGING Pro WordPress Backup Plugin is affected by a Cross-Site Request Forgery vulnerability that allows unauthenticated attackers to exploit missing or incorrectly implemented nonce validation on the 'sub' parameter. This flaw enables attackers to manipulate site administrators into executing malicious requests, which can result in the exposure of local files ending in '-settings.php'. This vulnerability is present in all versions up to and including 5.6.0, posing significant risks for users relying on this backup solution.

Affected Version(s)

WP STAGING Pro WordPress Backup Plugin * <= 5.6.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wp-staging/tru...
https://wp-staging.com/

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Matthew Rollings
.