CVE-2023-7204 is a data exposure flaw in the WP STAGING WordPress Backup plugin. Versions before 3.2.0 let an unauthenticated visitor reach cache files created during cloning. NVD scores it 7.5 (High). WPScan lists 3.2.0 as the fixed version, so update to 3.2.0 or later.
What's affected
Affected: the WP STAGING WordPress Backup plugin (slug wp-staging) in every version before 3.2.0. Fixed: 3.2.0, according to the WPScan entry.
The NVD description in the record is cut off mid sentence, so the exact content of the exposed cache files is not stated there. The vector is network reachable with no privileges and a high confidentiality impact.
Source conflict: NVD gives CVSS 7.5 and classifies the weakness as CWE-668 (exposure of a resource to the wrong sphere). The WPScan entry rates it 8.2 (high), classifies it as sensitive data disclosure under CWE-200, and credits the report to a researcher at CleanTalk. Both agree on the fixed version. The title follows the NVD score. KEV is false, and neither source says it is exploited in the wild.
How to check if you're exposed
On the server, WP-CLI reports the version directly.
wp plugin list --name=wp-staging --fields=name,status,version
Or open Plugins in the WordPress admin and read the version under WP STAGING. Anything below 3.2.0 is affected. If you run many sites, check each one, including staging copies that may still be reachable from the internet.
What to do now
- Update WP STAGING to 3.2.0 or later on every site, production and staging.
- Look for leftover cache or clone files in the plugin's folders and the uploads area, and delete any you do not need. I did not confirm exact file locations from the advisory, so check the plugin documentation.
- If the site was reachable during a clone operation, review what the cache could have held and rotate any secrets stored in the site configuration.
- Restrict staging sites with a login or an IP allow list so they are not public.
Why it matters
The weakness here is exposure: something the plugin writes for its own use during cloning can be fetched by someone with no account. Backup and migration plugins handle some of the most sensitive material on a WordPress site, including database content and configuration, so a small leak can be a large one.
The lesson for site owners is to treat temporary files from backup tools as sensitive data, keep them out of web accessible paths where possible, and update such plugins promptly.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes CVE-2023-7204?
WP STAGING 3.2.0, per the WPScan entry. Check the plugin changelog if you need to confirm.
Why do the scores differ?
NVD scores it 7.5 and WPScan scores it 8.2. Different scorers weigh the impact differently. Both treat it as high.
Sources
Last reviewed: 19 October 2026.
