Wordpress Alert: Staging-to-production credential reuse

What it looks like

A staging site's exposed password or token also works on production.

Why it matters

Compromise of the test site may lead to production access.

What to check

Separate credentials and revoke shared secrets.

Documentation

This is an exploit pattern to check in installed components, not a claim that every WordPress site has this flaw. Confirm the product and version against its advisories before treating a site as affected. See OWASP authentication guidance, WordPress hardening guide.