CVE-2024-5551 is a high severity (CVSS 7.5) cross site request forgery in the WP STAGING WordPress backup plugin, in all versions up to and including 5.6.0. A forged request can include local files ending in settings.php. The advisory page should be checked for the fixed release.
What's affected
The record says all versions up to and including 5.6.0 are affected. It names both the WP STAGING Pro plugin and the WP STAGING backup and migration plugin, because the vulnerable code is shared, and it points at the file for the remote storages settings tab.
I could not load the Wordfence page the record links, so the fixed version is not confirmed here. The record lists the plugin's WordPress.org trunk file and the vendor site. Open the plugin changelog and install a release newer than 5.6.0 that mentions this fix before you close the ticket.
The score is 7.5 with CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. High attack complexity and required user interaction reflect that an administrator must be tricked into following a link while signed in.
How to check if you're exposed
If you have WP-CLI on the server, this prints the installed plugin version:
wp plugin list --fields=name,version,update | grep -i staging
Otherwise open the Plugins page in the WordPress dashboard and read the version under WP STAGING. A value of 5.6.0 or lower means you are in the range. If you run both the free and the Pro plugins, check each one.
Then list who holds the administrator role. The attack needs an administrator to click a crafted link, so fewer administrators who browse the web while logged in means less exposure.
What to do now
- Update WP STAGING (and WP STAGING Pro) to the newest release and confirm it is above 5.6.0.
- Read the changelog entry to verify it mentions the nonce or request validation fix.
- Have administrators sign out of WordPress when they are not using it, and avoid following links from untrusted email while signed in.
- Review administrator accounts and remove any that are unused.
- Run a plugin inventory across your sites so other outdated backup tools show up.
Why it matters
CWE-352, cross site request forgery, is what happens when a site accepts a state changing request without proof the user meant to send it. WordPress answers this with nonces, one time tokens tied to the user and action. The record says the check on the sub parameter was missing or incorrect.
What an attacker gains is the ability to make the plugin include a local file whose name ends in settings.php. That is narrower than it sounds, but file inclusion in a backup tool, which runs with broad file access, deserves respect. The record is not in CISA KEV. Plugins are a steady source of this kind of bug, which is why a plugin list per site is worth keeping.
Try it yourself
Whether a fix exists is the first question for any plugin bug. This demo shows how to see it at a glance.
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes CVE-2024-5551?
The record only says up to and including 5.6.0 is affected, and I could not confirm the fixed release from the linked Wordfence page. Check the plugin changelog for the release after 5.6.0.
Can an attacker exploit this without an administrator?
The record says the attack needs a site administrator to be tricked into an action such as clicking a link. That is why user interaction is required in the score.
Sources
Last reviewed: 19 October 2026.
