CVE-2024-3682

MEDIUM

WP STAGING/WP STAGING Pro <3.4.3/<5.4.3 - Info Disclosure

Title source: llm
STIX 2.1

Description

The WP STAGING and WP STAGING Pro plugins for WordPress are vulnerable to Sensitive Information Exposure in versions up to, and including, 3.4.3, and versions up to, and including, 5.4.3, respectively, via the ajaxSendReport function. This makes it possible for unauthenticated attackers to extract sensitive data from a log file, including system information and (in the Pro version) license keys. Successful exploitation requires an administrator to have used the 'Contact Us' functionality along with the "Enable this option to automatically submit the log files." option.

References (4)

Core 4

Scores

CVSS v3 5.3
EPSS 0.0058
EPSS Percentile 43.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-200
Status published
Products (3)
renehermi/WP STAGING WordPress Backup Plugin – Migration Backup Restore < 3.4.3
renehermi/WP STAGING – WordPress Backup, Restore & Migration < 3.4.3
WPStaging/WP STAGING Pro WordPress Backup Plugin < 5.4.3
Published Apr 26, 2024
Tracked Since Feb 18, 2026