CVE-2026-115871
Deferred Deferred - Pending Action

Arbitrary Directory Deletion in WP STAGING Plugin

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: Wordfence

Description
The WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 4.19.0. This is due to insufficient path validation in the `cleanStagingDirectory` function, where the `deleteDir` parameter is only stripped of whitespace and double slashes by `sanitizePath()` without removing `..` traversal sequences or enforcing containment within the staging directory, leaving the sole pre-deletion guard as a simple string equality check against the WordPress home path. This makes it possible for authenticated attackers, with administrator-level access and above, to recursively delete arbitrary directories on the server — including `wp-content`, `wp-admin`, or directories outside the WordPress installation on shared hosting — resulting in denial of service or permanent data loss. An attacker must sequence a clone start, cancellation, and restart to drive the `delete_job` cache into the `directory` step before re-cancelling with a manipulated `deleteDir` value supplied via the `wp_ajax_wpstg_cancel_clone` endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-115871
EUVD
EUVD-2026-124970

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
renehermi WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups From 0 (inc) to 4.19.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the WP STAGING WordPress plugin up to version 4.19.0. It allows authenticated attackers with admin access to delete arbitrary directories on the server by manipulating the deleteDir parameter. The flaw is due to insufficient path validation in the cleanStagingDirectory function, which fails to properly handle directory traversal sequences like ...

The plugin only checks if the path matches the WordPress home directory as a simple string equality, which can be bypassed. Attackers can recursively delete critical directories such as wp-content or wp-admin, leading to denial of service or permanent data loss.

Detection Guidance

Check for unauthorized directory deletions in WordPress installations using the WP STAGING plugin. Review server logs for suspicious wp_ajax_wpstg_cancel_clone requests with manipulated deleteDir parameters. Inspect plugin versions to confirm if 4.19.0 or earlier is installed.

Impact Analysis

If you use the WP STAGING plugin up to version 4.19.0, an attacker with admin access could delete important WordPress directories. This may cause your website to stop functioning, lose data permanently, or disrupt services if critical files are removed.

On shared hosting, attackers could even delete directories outside your WordPress installation, affecting other users or services on the same server.

Compliance Impact

This vulnerability could lead to data breaches or permanent data loss, which may violate GDPR or HIPAA requirements for data integrity and availability. If personal or sensitive data is deleted, organizations may face compliance violations, fines, or legal consequences.

Mitigation Strategies

Immediately update the WP STAGING plugin to the latest version beyond 4.19.0. If an update is unavailable, disable the plugin until a patch is released. Restrict administrator-level access to WordPress to reduce attack surface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115871. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...