CVE-2024-3412
WP STAGING WordPress Backup Plugin – Migration Backup Restore <= 3.4.3 - Authenticated (Admin+) Arbitrary File Upload
CVSS Score
9.1
EPSS Score
0.0%
EPSS Percentile
0th
The WP STAGING WordPress Backup Plugin – Migration Backup Restore plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wpstg_processing AJAX action in all versions up to, and including, 3.4.3. This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
| CWE | CWE-434 |
| Vendor | renehermi |
| Product | wp staging – wordpress backup, restore & migration |
| Published | May 29, 2024 |
| Last Updated | Apr 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for renehermi wp staging – wordpress backup, restore & migration
Be the first to know when new critical vulnerabilities affecting renehermi wp staging – wordpress backup, restore & migration are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
renehermi / WP STAGING – WordPress Backup, Restore & Migration
0 ≤ 3.4.3
References
Credits
haidv35