CVE-2023-6113 is a high severity (CVSS 7.5) information exposure in the WP STAGING backup plugin, before 3.1.3 for the free edition and before 5.1.3 for Pro. Unauthenticated visitors can learn key details about a running backup and download it later. Update to 3.1.3 or 5.1.3 and review your existing backup files.
What's affected
- Plugin: WP STAGING WordPress Backup Plugin (free) and WP STAGING Pro.
- Affected: free edition before 3.1.3, Pro edition before 5.1.3.
- Fixed: 3.1.3 (free) and 5.1.3 (Pro), per the NVD record and WPScan.
- Severity: 7.5 High in the NVD record. CleanTalk labels it critical and reports a proof of concept and an exploit as available.
- Reach: CleanTalk lists more than 80,000 active installations of the free edition.
How to check if you're exposed
In the WordPress admin, open Plugins and read the version shown under WP STAGING. With shell access and WP-CLI, this lists every installed plugin with its version, status and whether an update is waiting:
wp plugin list --fields=name,title,version,status,update
Find the row for WP STAGING and compare its version with the fixed version above. On a multisite network, run the same command on each site, because a plugin can be active on some sites and not others. The folders are wp-staging for the free edition and wp-staging-pro for Pro.
Check both editions if both are installed. Then look at where your site stores backups, and whether a normal browser session that is not logged in can fetch files from that folder. Do this only against your own site.
What to do now
- Update WP STAGING to 3.1.3 or later, or WP STAGING Pro to 5.1.3 or later.
- Review existing backup archives on the server, and delete the ones you do not need.
- Keep backups out of public web folders, or deny web access to the backup directory.
- Treat a backup as a copy of your whole site: database contents, user records and any secrets stored in it. If you suspect a backup was fetched, rotate credentials stored in the site database and salts in the configuration.
- Switch on offsite backup storage so archives do not need to live next to the site files.
Why it matters
A site backup is the most sensitive file a WordPress site produces, since it holds the database and configuration. The record says the plugin does not stop visitors from learning key information about backup jobs in progress. WPScan explains that temporary cache files created during a backup are publicly readable, and that they reveal enough for someone to work out where the finished archive lives. The record lists no weakness identifier.
Notice the shape of this flaw. The archive itself was not open to the world. The secret name of the file was, through a side channel. Security that relies on an unguessable file name works only if nothing leaks the name. CleanTalk says the author fixed it quickly after being told. The record does not list this CVE as known exploited. Continuous monitoring of the plugins you run helps catch advisories like this soon after they appear.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is updating enough?
Updating stops new leaks. Archives made earlier may still sit in an exposed folder, so remove them and secure the folder.
Sources
Last reviewed: 19 October 2026.
