CVE-2026-115871

The WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 4.19.0. This is due to insufficient path validation in the cleanStagingDirectory function, where the deleteDir parameter is only stripped of whitespace and double slashes by sanitizePath() without removing .. traversal sequences or enforcing containment within the staging directory, leaving the sole pre-deletion guard as a simple string equality check against the WordPress home path. This makes it possible for authenticated attackers, with administrator-level access and above, to recursively delete arbitrary directories on the server — including wp-content, wp-admin, or directories outside the WordPress installation on shared hosting — resulting in denial of service or permanent data loss.