3.8
Low
CVE-2025-12656 The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory…
Description
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation in the delete_cancel_staging_site() function in all versions up to, and including, 0.9.128. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary folders on the server, which leads to a loss of data.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WPvivid — Backup, Migration & Staging 0.9 | earliest → 0.9.128 | No fix stated |
Other CVEs of WPvivid — Backup, Migration & Staging
The 16 CVEs of WPvivid — Backup, Migration & Staging →
CVE-2026-17555
The WPvivid Backup & Migration plugin for WordPress is vulnerable to SQL Injection via the export_data parameter in…
4.9
Medium
CVE-2026-1357
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to Unauthenticated…
9.8
Critical
CVE-2025-12654
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory…
2.7
Low
CVE-2025-5961
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads…
7.2
High