WPvivid vulnerabilities
4 known CVE vulnerabilities in WPvivid, translated and rated.
- CVE-2026-82194Unknown
The WPvivid — Backup, Migration & Staging WordPress plugin before version 0.9.134 does not validate a user supplied path before using it in a file deletion routine, allowing administrators to delete arbitrary files on the server, including files outside the web root.
- CVE-2026-82193Unknown
The WPvivid — Backup, Migration & Staging WordPress plugin before version 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrators to write files of permitted types to arbitrary locations on the server and to overwrite existing files.
- CVE-2026-82182Medium
The WPvivid — Backup, Migration & Staging WordPress plugin before version 0.9.133 does not sanitize a user-supplied list of identifiers before using it in a SQL query, allowing administrators to perform SQL injection attacks.
- CVE-2026-19722Medium
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files extracted from a backup package during restoration, allowing high privilege users such as administrators to write arbitrary files outside the intended restore directory, which can lead to code execution.