---
id: "CVE-2026-115871"
page: "https://infrastack.ai/live/CVE-2026-115871"
kind: "vulnerability"
aliases: ["CVE-2026-115871"]
title: "WP STAGING plugin for WordPress: admins can delete arbitrary server directories"
severity: "low"
cvss: 2.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "shared-hosting", "wordpress", "wp-staging"]
not_affected_if: ["fixed-version", "no-untrusted-admins", "plugin-not-installed"]
published_at: "2026-11-13T10:17:25+00:00"
first_seen_at: "2026-11-13T10:47:09+00:00"
updated_at: "2026-11-13T10:59:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115871", "first_seen_at": "2026-11-13T10:47:09+00:00"}]
exploit_sources: []
---

# WP STAGING plugin for WordPress: admins can delete arbitrary server directories

Link for people: https://infrastack.ai/live/CVE-2026-115871 (this .md is for agents)

Up to and including version 4.19.0, the WP STAGING WordPress plugin fails to strip directory traversal sequences from a path used in a recursive delete. An authenticated administrator can delete arbitrary directories on the server, including wp-content, wp-admin, or directories outside the WordPress install.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed WP STAGING version in the WordPress admin plugin list or with `wp plugin get wp-staging --field=version`
- Confirm whether the plugin is installed at all in the plugins directory

## Fix

- WP STAGING versions after `4.19.0` (fixed version unknown from sources)

## Timeline

- 2026-11-13T10:47:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115871

## From the sources

The WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 4.19.0. This is due to insufficient path validation in the `cleanStagingDirectory` function, where the `deleteDir` parameter is only stripped of whitespace and double slashes by `sanitizePath()` without removing `..` traversal sequences or enforcing containment within the staging directory, leaving the sole pre-deletion guard as a simple string equality check against the WordPress home path. This makes it possible for authenticated attackers, with administrator-level access and above, to recursively delete arbitrary directories on the server — including `wp-content`, `wp-admin`, or directories outside the WordPress installation on shared hosting — resulting in denial of service or permanent data loss. An attacker must sequence a clone start, cancellation, and restart to drive the `delete_job` cache into the `directory` step before re-cancelling with a manipulated `deleteDir` value supplied via the `wp_ajax_wpstg_cancel_clone` endpoint.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_