CVE-2026-19725
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131 does not sanitize a value from an unauthenticated request before using it to build a log file path, allowing an attacker holding a site-to-site transfer key to create a log file in any existing writable directory, including the web root. The file name has a fixed suffix and contents are the plugin's own log header, so only the file location is attacker-controlled.
Risk Assessment
An attacker can create a file in sensitive locations, potentially leading to system clutter or exploitation in combination with other vulnerabilities, but direct risk is limited.
Recommendation
Update the WPvivid plugin to version 0.9.131 or later. Ensure transfer keys are strong and not shared with unauthorized parties.
Original NVD description (English source)
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131 does not sanitise a value taken from an unauthenticated request before using it to build a log file path, allowing an attacker holding a site to site transfer key to create a log file in any existing writable directory of the site, including the web root. The file name always carries a fixed suffix and the contents are always the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131's own log header, so only the location of the file is attacker controlled.