{"id":"CVE-2026-115871","kind":"vulnerability","aliases":["CVE-2026-115871"],"related":[],"title":"WP STAGING plugin for WordPress: admins can delete arbitrary server directories","description":"The WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 4.19.0. This is due to insufficient path validation in the `cleanStagingDirectory` function, where the `deleteDir` parameter is only stripped of whitespace and double slashes by `sanitizePath()` without removing `..` traversal sequences or enforcing containment within the staging directory, leaving the sole pre-deletion guard as a simple string equality check against the WordPress home path. This makes it possible for authenticated attackers, with administrator-level access and above, to recursively delete arbitrary directories on the server — including `wp-content`, `wp-admin`, or directories outside the WordPress installation on shared hosting — resulting in denial of service or permanent data loss. An attacker must sequence a clone start, cancellation, and restart to drive the `delete_job` cache into the `directory` step before re-cancelling with a manipulated `deleteDir` value supplied via the `wp_ajax_wpstg_cancel_clone` endpoint.","summary":"Up to and including version 4.19.0, the WP STAGING WordPress plugin fails to strip directory traversal sequences from a path used in a recursive delete. An authenticated administrator can delete arbitrary directories on the server, including wp-content, wp-admin, or directories outside the WordPress install.","severity":"low","cvss":2.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","shared-hosting","wordpress","wp-staging"],"not_affected_if":["fixed-version","no-untrusted-admins","plugin-not-installed"],"how_to_check":"- Check the installed WP STAGING version in the WordPress admin plugin list or with `wp plugin get wp-staging --field=version`\n- Confirm whether the plugin is installed at all in the plugins directory","fix":"- WP STAGING versions after `4.19.0` (fixed version unknown from sources)","status":"open","published_at":"2026-11-13T10:17:25+00:00","first_seen_at":"2026-11-13T10:47:09+00:00","triaged_at":"2026-11-13T10:59:01+00:00","updated_at":"2026-11-13T10:59:01+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:59:01Z","model":"claude-haiku-5-5","output":{"fix":"- WP STAGING versions after `4.19.0` (fixed version unknown from sources)","reach":"network","title":"WP STAGING plugin for WordPress: admins can delete arbitrary server directories","impact":"high","summary":"Up to and including version 4.19.0, the WP STAGING WordPress plugin fails to strip directory traversal sequences from a path used in a recursive delete. An authenticated administrator can delete arbitrary directories on the server, including wp-content, wp-admin, or directories outside the WordPress install.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-staging","shared-hosting"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Arbitrary server directories deleted, causing denial of service or data loss","analyst_note":"","how_to_check":"- Check the installed WP STAGING version in the WordPress admin plugin list or with `wp plugin get wp-staging --field=version`\n- Confirm whether the plugin is installed at all in the plugins directory","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","fixed-version","no-untrusted-admins"],"who_is_affected":"Sites running WP STAGING version 4.19.0 or earlier are exposed, with the risk limited to users who already hold administrator rights. Shared hosting setups where the WordPress install shares a filesystem with other sites carry the most damage potential. Sites without this plugin or on a fixed version can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000771,"input_tokens":4862,"output_tokens":569,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-115871':14A,17A '-2026':13A,16A '4.19.0':31B,102C 'access':168C 'admin':6A,67B,185C 'administr':53B,166C 'administrator-level':165C 'ajax':237C 'arbitrari':9A,56B,92C,174C 'attack':163C,205C 'authent':52B,162C 'backup':77C,83C,85C 'cach':219C 'cancel':211C,227C,239C 'check':151C 'cleanstagingdirectori':112C 'clone':80C,209C,240C 'cloud':82C 'contain':134C 'content':64B,182C 'cve':12A,15A 'data':202C 'delet':8A,50B,55B,94C,144C,173C,217C 'deletedir':116C,231C 'denial':197C 'directori':11A,40B,57B,69B,93C,138C,175C,187C,222C 'doubl':124C 'drive':215C 'due':105C 'endpoint':241C 'enforc':133C 'equal':150C 'fail':37B 'function':113C 'guard':145C 'home':155C 'host':21B,194C 'includ':29B,61B,101C,179C 'instal':73B,191C 'insuffici':107C 'job':218C 'leav':139C 'level':167C 'loss':203C 'make':158C 'manipul':230C 'migrat':79C 'must':206C 'outsid':70B,188C 'packag':18B 'paramet':117C 'path':45B,108C,156C 'perman':201C 'plugin':3A,36B,81C,86C 'possibl':160C 'pre':143C 'pre-delet':142C 're':226C 're-cancel':225C 'recurs':49B,172C 'remov':129C 'restart':213C 'restor':78C 'result':195C 'sanitizepath':127C 'schedul':84C 'sequenc':42B,131C,207C 'server':10A,60B,178C 'servic':199C 'share':20B,193C 'shared-host':19B 'simpl':148C 'slash':125C 'sole':141C 'stage':2A,25B,34B,76C,137C 'start':210C 'step':223C 'string':149C 'strip':39B,120C 'suppli':233C 'travers':41B,130C 'use':46B 'valid':109C 'valu':232C 'version':30B,97C 'via':234C 'vulner':90C 'whitespac':122C 'within':135C 'without':128C 'wordpress':5A,22B,35B,72B,88C,154C,190C 'wp':1A,24B,33B,63B,66B,75C,181C,184C,236C 'wp-admin':65B,183C 'wp-content':62B,180C 'wp-stage':23B 'wpstg':238C","nicknames":[],"mitigations":[],"who_affected":"Sites running WP STAGING version 4.19.0 or earlier are exposed, with the risk limited to users who already hold administrator rights. Shared hosting setups where the WordPress install shares a filesystem with other sites carry the most damage potential. Sites without this plugin or on a fixed version can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["low","package","sharedhosting","wordpress","wpstaging"],"campaign_type":null,"search_a":"'-115871':14A,17A '-2026':13A,16A 'admin':6A 'arbitrari':9A 'cve':12A,15A 'delet':8A 'directori':11A 'plugin':3A 'server':10A 'stage':2A 'wordpress':5A 'wp':1A","search_b":"'4.19.0':31B 'admin':67B 'administr':53B 'arbitrari':56B 'authent':52B 'content':64B 'delet':50B,55B 'directori':40B,57B,69B 'fail':37B 'host':21B 'includ':29B,61B 'instal':73B 'outsid':70B 'packag':18B 'path':45B 'plugin':36B 'recurs':49B 'sequenc':42B 'server':60B 'share':20B 'shared-host':19B 'stage':25B,34B 'strip':39B 'travers':41B 'use':46B 'version':30B 'wordpress':22B,35B,72B 'wp':24B,33B,63B,66B 'wp-admin':65B 'wp-content':62B 'wp-stage':23B","search_c":"'4.19.0':102C 'access':168C 'admin':185C 'administr':166C 'administrator-level':165C 'ajax':237C 'arbitrari':92C,174C 'attack':163C,205C 'authent':162C 'backup':77C,83C,85C 'cach':219C 'cancel':211C,227C,239C 'check':151C 'cleanstagingdirectori':112C 'clone':80C,209C,240C 'cloud':82C 'contain':134C 'content':182C 'data':202C 'delet':94C,144C,173C,217C 'deletedir':116C,231C 'denial':197C 'directori':93C,138C,175C,187C,222C 'doubl':124C 'drive':215C 'due':105C 'endpoint':241C 'enforc':133C 'equal':150C 'function':113C 'guard':145C 'home':155C 'host':194C 'includ':101C,179C 'instal':191C 'insuffici':107C 'job':218C 'leav':139C 'level':167C 'loss':203C 'make':158C 'manipul':230C 'migrat':79C 'must':206C 'outsid':188C 'paramet':117C 'path':108C,156C 'perman':201C 'plugin':81C,86C 'possibl':160C 'pre':143C 'pre-delet':142C 're':226C 're-cancel':225C 'recurs':172C 'remov':129C 'restart':213C 'restor':78C 'result':195C 'sanitizepath':127C 'schedul':84C 'sequenc':131C,207C 'server':178C 'servic':199C 'share':193C 'simpl':148C 'slash':125C 'sole':141C 'stage':76C,137C 'start':210C 'step':223C 'string':149C 'strip':120C 'suppli':233C 'travers':130C 'valid':109C 'valu':232C 'version':97C 'via':234C 'vulner':90C 'whitespac':122C 'within':135C 'without':128C 'wordpress':88C,154C,190C 'wp':75C,181C,184C,236C 'wp-admin':183C 'wp-content':180C 'wpstg':238C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T10:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115871","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115871","severity":null,"published_at":"2026-11-13T10:17:25+00:00","modified_at":"2026-11-13T10:17:25+00:00","first_seen_at":"2026-11-13T10:47:09+00:00","fetched_at":"2026-11-13T10:47:09+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}