CVE-2025-12656
LowCVSS 3.8Summary
The WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation in the delete_cancel_staging_site() function. This affects all versions up to and including 0.9.128.
Risk Assessment
Authenticated attackers with Administrator-level access can delete arbitrary folders on the server, leading to data loss.
Recommendation
It is recommended to update the plugin to the latest version to mitigate this vulnerability and to restrict access to Administrator accounts.
Original NVD description (English source)
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation in the delete_cancel_staging_site() function in all versions up to, and including, 0.9.128. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary folders on the server, which leads to a loss of data.