5.5
Medium
CVE-2026-115426 WPvivid Backup & Migration < 0.9.138 - Admin+ Path Traversal via Local Backup Directory Setting
Description
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.138 does not properly validate a backup storage directory path before using it to create directories and write files, allowing administrators to cause those directories and files to be created outside the intended backup location via path traversal.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:LExploitable remotely over the network, with an administrator account and without any user action; the impact on data or service is limited.
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- High
- Interaction
- None
- Scope
- Changed
- Confidentiality
- None
- Integrity
- Low
- Availability
- Low
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WPvivid — Backup, Migration & Staging 0.9 | earliest → < 0.9.138 | 0.9.138 |
Other CVEs of WPvivid — Backup, Migration & Staging
The 9 CVEs of WPvivid — Backup, Migration & Staging →
CVE-2026-115243
WPvivid Backup & Migration 0.9.117 - 0.9.136 - Admin+ Arbitrary File Upload via wpvivid_upload_import_files
6.7
Medium
CVE-2026-115242
WPvivid Backup & Migration < 0.9.137 - Admin+ Path Traversal via Staging Site Path
5.5
Medium
CVE-2026-115241
WPvivid Backup & Migration < 0.9.137 - Admin+ Arbitrary Database Table Deletion via Snapshot ID
6.5
Medium
CVE-2026-82194
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied path…
5.5
Medium