WP STAGING plugin for WordPress: admins can delete arbitrary server directories

The WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 4.19.0. This is due to insufficient path validation in the cleanStagingDirectory function, where the deleteDir parameter is only stripped of whitespace and double slashes by sanitizePath() without removing .. traversal sequences or enforcing containment within the staging directory, leaving the sole pre-deletion guard as a simple string equality check against the WordPress home path. This makes it possible for authenticated attackers, with administrator-level access and above, to recursively delete arbitrary directories on the server — including wp-content, wp-admin, or directories outside the WordPress installation on shared hosting — resulting in denial of service or permanent data loss. An attacker must sequence a clone start, cancellation, and restart to drive the delete_job cache into the directory step before re-cancelling with a manipulated deleteDir value supplied via the wp_ajax_wpstg_cancel_clone endpoint.