We welcome reports of security issues in WP Staging Free and WP Staging Pro. Send them privately to support @ wp-staging.com. Do not report them in a public forum or issue tracker.
What a report must contain
- The affected plugin and the exact version you tested.
- A step-by-step reproduction on a default WordPress installation, with a working proof of concept.
- The real impact: what an attacker gains, and which role or access they need.
Reports that cannot be reproduced from what they contain are closed without further discussion.
Reports we close without review
- Reports generated or written by AI tools or automated scanners that were not verified by hand against a running installation.
- Theoretical issues without a working proof of concept.
- Issues that require full administrator access (super admin on multisite), or that rely on administrators being able to run code or post arbitrary JavaScript.
- Disclosure of the WP STAGING version number.
- CSV injection, missing security headers or SSL/TLS configuration, and content spoofing without a demonstrated attack.
- Deviations from best practices without a demonstrated impact.
Disclosure
Keep your findings confidential until a fix has been released and we have agreed on disclosure with you.