CVE-2025-12656
LowCVSS 3.8Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Vulnerability in the WPvivid Backup & Migration WordPress plugin (up to version 0.9.128) allows an authenticated attacker with Administrator-level access to delete arbitrary directories on the server via the delete_cancel_staging_site() function due to insufficient path validation.
Risk Assessment
An attacker can delete critical system directories or backup data, leading to data loss and site downtime.
Recommendation
Update the WPvivid Backup & Migration plugin to version 0.9.129 or later. Limit the number of administrator accounts and regularly audit permissions.
Other vulnerabilities in WPvivid Backup & Migration
See all- CVE-2026-17555Medium
The WPvivid Backup & Migration plugin for WordPress up to version 0.9.131 contains a SQL Injection vulnerability via the export_data parameter. Authenticated attackers with administrator-level access and above can append additional SQL queries to existing queries, allowing extraction of sensitive database information.
- CVE-2025-12654Low
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory creation in all versions up to, and including, 0.9.120. The check_filesystem_permissions() function does not properly restrict the directories that can be created or their location, allowing authenticated attackers with Administrator-level access to create arbitrary directories.
Original NVD description (English source)
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation in the delete_cancel_staging_site() function in all versions up to, and including, 0.9.128. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary folders on the server, which leads to a loss of data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS