CVE-2026-115871: WP STAGING <= 4.19.0 - Authenticated (Administrator+) Arbitrary Directory Deletion via 'deleteDir' Parameter
The WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 4.19.0. This is due to insufficient path validation in the cleanStagingDirectory function, where the deleteDir parameter is only stripped of whitespace and double slashes by sanitizePath() without removing .. traversal sequences or enforcing containment within the staging directory, leaving the sole pre-deletion guard as a simple string equality check against the WordPress home path. This makes it possible for authenticated attackers, with administrator-level access and above, to recursively delete arbitrary directories on the server — including wp-content, wp-admin, or directories outside the WordPress installation on shared hosting — resulting in denial of service or permanent data loss. An attacker must sequence a clone start, cancellation, and restart to drive the deletejob cache into the directory step before re-cancelling with a manipulated deleteDir value supplied via the wpajaxwpstgcancelclone endpoint.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs authenticated WordPress administrator-level access or higher. The vulnerable action is exposed through the wp_ajax_wpstg_cancel_clone endpoint.
What conditions are required for exploitation?
The attacker must manipulate the clone workflow: start a clone, cancel it, restart it so the delete_job cache reaches the directory step, then cancel again while supplying a crafted deleteDir value. The flaw relies on path traversal sequences not being removed or constrained to the staging directory.
What could an attacker delete?
A successful exploit can recursively delete arbitrary server directories, including wp-content, wp-admin, and potentially directories outside the WordPress installation on shared hosting. The stated impacts are denial of service and permanent data loss.
Are default installations affected?
All plugin versions through 4.19.0 are described as affected. Exploitation still requires an administrator-level authenticated account and the specific clone cancellation sequence.