Wordpress Wp Staging Pro plugin <= 5.6.0 - Cross-Site Request Forgery to Limited Local File Inclusion vulnerability

Cross-Site Request Forgery to Limited Local File Inclusion vulnerability discovered by stealthcopter in WordPress Plugin Wp Staging Pro versions = 5.6.0...

WordPress Wp Staging Pro Plugin <= 5.6.0 is vulnerable to Local File Inclusion

Software Wp Staging Pro Type Plugin Vulnerable versions = 5.6.0 Fixed in 5.6.1 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-5551 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 9b2908e7bf24 Credits stealthcopter Required privilege...

CVE-2024-5551: Cross-Site Request Forgery (CSRF)

The WP STAGING Pro WordPress Backup Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.6.0. This is due to missing or incorrect nonce validation on the 'sub' parameter called from the WP STAGING WordPress Backup Plugin - Backup Duplicat...

WordPress plugin WP STAGING Pro WordPress Backup Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin WP STAGING...

CVE-2024-4898: Missing Authorization

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authorization checks on the REST API calls in all versions up to, and including, 0.1.0.38. This makes it possible for unauthenticated attackers to connect the site ...

CVE-2024-4469 Migration Backup Restore < 3.5.0 - Admin+ SSRF

The WP STAGING WordPress Backup Plugin WordPress plugin before 3.5.0 does not prevent users with the administrator role from pinging conducting SSRF attacks, which may be a problem in multisite configurations...

WordPress plugin WP STAGING security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2024-31213 · WordPress · Wp Staging

Name of the Vulnerable Software and Affected Versions: WP STAGING WordPress Backup Plugin versions prior to 3.5.0 Description: The issue allows users with the administrator role to conduct SSRF attacks, which may be problematic in multisite configurations. This is due to the lack of prevention of...

WordPress WP STAGING – Backup Duplicator & Migration Plugin < 3.5.0 is vulnerable to Server Side Request Forgery (SSRF)

Software WP STAGING – Backup Duplicator & Migration Type Plugin Vulnerable versions 3.5.0 Fixed in 3.5.0 OWASP Top 10 A1: Broken Access Control Classification Server Side Request Forgery SSRF CVE CVE-2024-4469 Patch priority Low CVSS severity Low 5.5 Developer Claim ownership PSID 76283163b094...

CVE-2024-4469: Server-Side Request Forgery (SSRF)

The WP STAGING WordPress Backup Plugin WordPress plugin before 3.5.0 does not prevent users with the administrator role from pinging conducting SSRF attacks, which may be a problem in multisite configurations...

CVE-2024-3412

CVE-2024-3412 affects the WP STAGING WordPress Backup Plugin – Migration Backup Restore. It is vulnerable in versions

CVE-2024-3412: Unrestricted Upload of File with Dangerous Type

The WP STAGING WordPress Backup Plugin – Migration Backup Restore plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wpstgprocessing AJAX action in all versions up to, and including, 3.4.3. This makes it possible for authenticated attackers, wi...

WordPress WP STAGING – Backup Duplicator & Migration Plugin <= 3.4.3 is vulnerable to Arbitrary File Upload

Software WP STAGING – Backup Duplicator & Migration Type Plugin Vulnerable versions = 3.4.3 Fixed in 3.5.0 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-3412 Patch priority Low CVSS severity Low 7.2 Developer Claim ownership PSID af3b452b0d24 Credits haidv35 Require...

CVE-2024-2667: Unrestricted Upload of File with Dangerous Type

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation in the /wp-json/instawp-connect/v1/config REST API endpoint in all versions up to, and including, 0.1.0.22. This makes it possible for...

WordPress WP STAGING Pro plugin <= 5.4.3 - Sensitive Information Exposure via Log File vulnerability

Sensitive Information Exposure via Log File vulnerability discovered by haidv35 in WordPress Plugin Wp Staging Pro versions = 5.4.3...

WordPress Wp Staging Pro Plugin <= 5.4.3 is vulnerable to Sensitive Data Exposure

Software Wp Staging Pro Type Plugin Vulnerable versions = 5.4.3 Fixed in 5.5.0 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-3682 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID eb5b93b83c9e Credits haidv35 Required privilege...

PT-2024-27169

Name of the Vulnerable Software and Affected Versions WP STAGING versions up to 3.4.3 WP STAGING Pro versions up to 5.4.3 Description The issue allows unauthenticated attackers to extract sensitive data from a log file, including system information and license keys, via the ajaxSendReport functio...

CVE-2024-3682: Exposure of Sensitive Information to an Unauthorized Actor

The WP STAGING and WP STAGING Pro plugins for WordPress are vulnerable to Sensitive Information Exposure in versions up to, and including, 3.4.3, and versions up to, and including, 5.4.3, respectively, via the ajaxSendReport function. This makes it possible for unauthenticated attackers to extrac...

CVE-2024-2309 WP Staging < 3.4.0, 5.4.0 (Pro Version) - Admin+ Stored XSS

The WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro WordPress plugin before 5.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml...

CVE-2024-2309 WP Staging < 3.4.0, 5.4.0 (Pro Version) - Admin+ Stored XSS

The WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro WordPress plugin before 5.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml...