{"id":"CVE-2023-6113","state":"PUBLISHED","title":"WP Staging (Free < 3.1.3, Pro < 5.1.3) - Unauthenticated Backup Download","description":"The WP STAGING WordPress Backup Plugin before 3.1.3 and WP STAGING Pro WordPress Backup Plugin before 5.1.3 do not prevent visitors from leaking key information about ongoing backups processes, allowing unauthenticated attackers to download said backups later.","publishedAt":"2024-01-01T14:18:58.931Z","updatedAt":"2025-06-18T14:57:10.430Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"CISA-ADP"},"assigner":"WPScan","products":["Unknown WP STAGING WordPress Backup Plugin","Unknown WP STAGING Pro WordPress Backup Plugin"],"affected":[{"vendor":"Unknown","product":"WP STAGING WordPress Backup Plugin","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.1.3","versionType":"semver"}],"collectionURL":"https://wordpress.org/plugins"},{"vendor":"Unknown","product":"WP STAGING Pro WordPress Backup Plugin","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.1.3","versionType":"semver"}]}],"references":["https://wpscan.com/vulnerability/5a71049a-09a6-40ab-a4e8-44634869d4fb","https://research.cleantalk.org/cve-2023-6113-wp-staging-unauth-sensitive-data-exposure-to-account-takeover-poc-exploit/"],"weaknesses":[],"ingestedAt":"2026-10-29T20:06:42.242Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/6xxx/CVE-2023-6113.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-6113","state":"PUBLISHED","datePublished":"2024-01-01T14:18:58.931Z","dateUpdated":"2025-06-18T14:57:10.430Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2023-11-13T21:19:58.462Z"},"containers":{"cna":{"title":"WP Staging (Free < 3.1.3, Pro < 5.1.3) - Unauthenticated Backup Download","descriptions":[{"lang":"en","value":"The WP STAGING WordPress Backup Plugin before 3.1.3 and WP STAGING Pro WordPress Backup Plugin before 5.1.3 do not prevent visitors from leaking key information about ongoing backups processes, allowing unauthenticated attackers to download said backups later."}],"affected":[{"vendor":"Unknown","product":"WP STAGING WordPress Backup Plugin","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.1.3","versionType":"semver"}],"collectionURL":"https://wordpress.org/plugins"},{"vendor":"Unknown","product":"WP STAGING Pro WordPress Backup Plugin","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.1.3","versionType":"semver"}]}],"references":[{"url":"https://wpscan.com/vulnerability/5a71049a-09a6-40ab-a4e8-44634869d4fb","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://research.cleantalk.org/cve-2023-6113-wp-staging-unauth-sensitive-data-exposure-to-account-takeover-poc-exploit/","tags":["technical-description"]}],"problemTypes":[{"descriptions":[{"description":"CWE-200 Information Exposure","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2024-01-01T14:18:58.931Z"},"credits":[{"lang":"en","value":"Dmitrii Ignatyev","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://wpscan.com/vulnerability/5a71049a-09a6-40ab-a4e8-44634869d4fb","tags":["exploit","vdb-entry","technical-description","x_transferred"]},{"url":"https://research.cleantalk.org/cve-2023-6113-wp-staging-unauth-sensitive-data-exposure-to-account-takeover-poc-exploit/","tags":["technical-description","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T08:21:17.325Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-01-02T14:42:19.402865Z","id":"CVE-2023-6113","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-06-18T14:57:10.430Z"}}]}}}