The WP STAGING Pro WordPress Backup Plugin contains an information exposure vulnerability (CWE-200) in versions up to and including 6.1.2. The vulnerability arises because the getOutdatedPluginsRequest() function lacks proper capability checks, enabling unauthenticated attackers to retrieve a list of outdated installed plugins, whether active or inactive. This could aid attackers in identifying potential targets for further exploitation. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, no privileges required, and limited confidentiality impact.

An unauthenticated attacker can disclose information about outdated plugins installed on a WordPress site using the vulnerable WP STAGING Pro plugin. This information exposure may assist attackers in identifying vulnerable components but does not directly compromise integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the plugin's functionality or disabling the plugin if feasible to prevent unauthorized information disclosure.