WP STAGING takes security seriously. This page explains how to report a security issue in WP STAGING Free or WP STAGING Pro, what happens after you send a report, and which versions we accept reports for.
Report a vulnerability
Send your report privately to support@wp-staging.com. Please do not open a public issue, a support-forum thread or a social-media post about an unfixed security problem — that is what puts our users at risk while no update exists yet.
The private security-advisory form of our free plugin repository works as an alternative: github.com/wp-staging/wp-staging/security/advisories. Either channel is fine; please use one of them, not both.
What a usable report contains, which reports we close without review, and how we agree on disclosure is described on the companion page Submit a security report.
What happens after you send a report
- Someone from the development team replies and tells you whether the report reproduces on a current installation.
- A fix ships in the next release that fits the severity, and the release notes say what was found and which version fixes it.
- Disclosure is agreed together: keep the findings confidential until the fix is released, and tell us when you intend to publish, so your publication and the update reaching our installations do not leave a window open.
- If a report needs a published CVE to be tracked by our customers’ security tooling, we request one for it.
Versions we accept reports for
- The latest stable WP STAGING Free from WordPress.org and the latest WP STAGING Pro from your account. Both are listed in the changelog.
- Not in scope: versions that a current release already fixes, and modified copies of our code that third-party “GPL” shops hand out. Those copies are not maintained by us and their owners cannot update them.
Severity scoring
If you are familiar with CVSS 3.1, add a vector string to your report — the CVSS calculator helps with that. A missing or wrong score is not a reason to close a report: we score it ourselves. The score decides how fast we ship a fix, not whether we fix it.
Writing about WP STAGING and security
If you plan to publish something about our security, please get in touch first, so that every claim in it is correct and your readers are told which version fixes the issue.