{"id":86047,"date":"2025-12-15T16:21:38","date_gmt":"2025-12-15T16:21:38","guid":{"rendered":""},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-30T00:00:00","slug":"cve-2023-6113-unauthenticated-information-leakage-in-wp-staging-wordpress-backup-plugins","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2023-6113-unauthenticated-information-leakage-in-wp-staging-wordpress-backup-plugins\/","title":{"rendered":"CVE-2023-6113: Unauthenticated Information Leakage in WP STAGING WordPress Backup Plugins<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

This report details the CVE-2023-6113 vulnerability, a critical flaw affecting both the WP STAGING WordPress Backup Plugin prior to version 3.1.3 and the WP STAGING Pro WordPress Backup Plugin prior to version 5.1.3. The vulnerability allows unauthenticated attackers to gain access to key information about ongoing backup processes and to download these backups. This poses a significant threat to WordPress sites using these plugins, as it may lead to system compromise or data leakage.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2023-6113
\nSeverity: High (7.5 on CVSS scale)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: Potential system compromise and data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

WP STAGING WordPress Backup Plugin | Before 3.1.3
\nWP STAGING Pro WordPress Backup Plugin | Before 5.1.3<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The WP STAGING and WP STAGING Pro WordPress Backup Plugins do not adequately protect information about ongoing backup processes. This allows an unauthenticated attacker to access the backup process information and subsequently download the backups. The attacker can then extract potentially sensitive data such as database content, configuration files, or proprietary code.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

GET \/wp-staging-backup-file HTTP\/1.1\nHost: vulnerable-wordpress-site.com<\/code><\/pre>\n
This simple HTTP GET request illustrates how an attacker might attempt to download a backup file from a vulnerable WordPress site. Note that the actual file location and request parameters would vary based on the specific site and backup configuration.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview This report details the CVE-2023-6113 vulnerability, a critical flaw affecting both the WP STAGING WordPress Backup Plugin prior to version 3.1.3 and the WP STAGING Pro WordPress Backup Plugin prior to version 5.1.3. The vulnerability allows unauthenticated attackers to gain access to key information about ongoing backup processes and to download these backups. This […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-86047","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t