CVE-2026-42696

CriticalCVSS 10.0

Published: 10/10/2026(UTC)Translated: 11/10/2026(UTC)NVD NIST

Summary

The SiteVault – Backup, Restore, Migration & Cloning plugin in versions up to and including 1.5.19 contains an unauthenticated Remote Code Execution (RCE) vulnerability. The lack of required authorization allows exploitation without an account.

Risk Assessment

An attacker can execute arbitrary code on the server, leading to full takeover of the website and potentially the entire server. This is one of the most severe possible threats.

Recommendation

Immediately update the SiteVault plugin to a version newer than 1.5.19 or disable it. Check server logs for signs of compromise.

Other vulnerabilities in SiteVault

CVE-2026-105071High
Unauthenticated Sensitive Data Exposure vulnerability in SiteVault – Backup, Restore, Migration & Cloning up to version 1.5.17 allows an unauthenticated attacker to access sensitive data.

Original NVD description (English source)

Unauthenticated Remote Code Execution (RCE) in SiteVault – Backup, Restore, Migration & Cloning <= 1.5.19 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS