CVE-2026-82182
MediumCVSS 4.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The WPvivid — Backup, Migration & Staging WordPress plugin before version 0.9.133 does not sanitize a user-supplied list of identifiers before using it in a SQL query, allowing administrators to perform SQL injection attacks.
Risk Assessment
An attacker with administrator privileges could exploit this vulnerability to manipulate the database, potentially leading to unauthorized data access or corruption.
Recommendation
Update the WPvivid plugin to version 0.9.133 or later, which includes a fix for SQL injection vulnerabilities.
Other vulnerabilities in WPvivid
See all- CVE-2026-82194Unknown
The WPvivid — Backup, Migration & Staging WordPress plugin before version 0.9.134 does not validate a user supplied path before using it in a file deletion routine, allowing administrators to delete arbitrary files on the server, including files outside the web root.
- CVE-2026-82193Unknown
The WPvivid — Backup, Migration & Staging WordPress plugin before version 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrators to write files of permitted types to arbitrary locations on the server and to overwrite existing files.
- CVE-2026-19722Medium
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files extracted from a backup package during restoration, allowing high privilege users such as administrators to write arbitrary files outside the intended restore directory, which can lead to code execution.
Original NVD description (English source)
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not sanitise a user supplied list of identifiers before using it in a SQL query, allowing administrators to perform SQL injection attacks.