2 lines
3.4 KiB
JSON
2 lines
3.4 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups","vendor":"renehermi","versions":[{"lessThanOrEqual":"4.19.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 4.19.0. This is due to insufficient path validation in the `cleanStagingDirectory` function, where the `deleteDir` parameter is only stripped of whitespace and double slashes by `sanitizePath()` without removing `..` traversal sequences or enforcing containment within the staging directory, leaving the sole pre-deletion guard as a simple string equality check against the WordPress home path. This makes it possible for authenticated attackers, with administrator-level access and above, to recursively delete arbitrary directories on the server — including `wp-content`, `wp-admin`, or directories outside the WordPress installation on shared hosting — resulting in denial of service or permanent data loss. An attacker must sequence a clone start, cancellation, and restart to drive the `delete_job` cache into the `directory` step before re-cancelling with a manipulated `deleteDir` value supplied via the `wp_ajax_wpstg_cancel_clone` endpoint."}],"id":"CVE-2026-115871","lastModified":"2026-11-13T10:17:25.213","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":2.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":1.4,"source":"security@wordfence.com","type":"Primary"}]},"published":"2026-11-13T10:17:25.070","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Backend/Administrator.php#L980"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Backend/Modules/Jobs/Delete.php#L547"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Backend/Modules/Jobs/Delete.php#L630"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Backend/Modules/Jobs/Delete.php#L95"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Framework/Filesystem/Filesystem.php#L416"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/wp-staging/tags/4.18.0/Framework/Utils/Sanitize.php#L165"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3787297%40wp-staging&new=3787297%40wp-staging"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/0bfa1392-375a-4be2-ad4d-2c9d5fe3267c?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-73"}],"source":"security@wordfence.com","type":"Primary"}]}
|