CVE-2023-6113: wp staging — Exploit

Description

The WP STAGING WordPress Backup Plugin before 3.1.3 and WP STAGING Pro WordPress Backup Plugin before 5.1.3 do not prevent visitors from leaking key information about ongoing backups processes, allowing unauthenticated attackers to download said backups later.

Is your site exposed to CVE-2023-6113?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected Products

Vendor	Product	Versions
wp-staging	wp_staging	< 3.1.3

References

Exploits

https://research.cleantalk.org/cve-2023-6113-wp-staging-unauth-sensitive-data-exposure-to-account-takeover-poc-exploit/ https://wpscan.com/vulnerability/5a71049a-09a6-40ab-a4e8-44634869d4fb https://research.cleantalk.org/cve-2023-6113-wp-staging-unauth-sensitive-data-exposure-to-account-takeover-poc-exploit/ https://wpscan.com/vulnerability/5a71049a-09a6-40ab-a4e8-44634869d4fb

Frequently Asked Questions

What is CVE-2023-6113? +

The WP STAGING WordPress Backup Plugin before 3.1.3 and WP STAGING Pro WordPress Backup Plugin before 5.1.3 do not prevent visitors from leaking key information about ongoing backups processes, allowing unauthenticated attackers to download said backups later. It has a CVSS v3.1 base score of 7.5 (HIGH).

How severe is CVE-2023-6113? +

CVE-2023-6113 has a CVSS v3.1 score of 7.5 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2023-6113? +

CVE-2023-6113 affects products from wp-staging, specifically: wp_staging. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2023-6113? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-5551 7.5

The WP STAGING Pro WordPress Backup Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up …

CVE-2023-7204 7.5

The WP STAGING WordPress Backup plugin before 3.2.0 allows access to cache files during the cloning process which provides

CVE-2024-4469 7.5

The WP STAGING WordPress Backup Plugin WordPress plugin before 3.5.0 does not prevent users with the administrator role from pinging …

CVE-2024-2309 4.8

The WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro WordPress plugin before 5.4.0 does not sanitise and escape …

CVE-2023-6113