WPvivid vulnerabilities

The WPvivid — Backup, Migration & Staging WordPress plugin before version 0.9.134 does not validate a user supplied path before using it in a file deletion routine, allowing administrators to delete arbitrary files on the server, including files outside the web root.

The WPvivid — Backup, Migration & Staging WordPress plugin before version 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrators to write files of permitted types to arbitrary locations on the server and to overwrite existing files.

The WPvivid — Backup, Migration & Staging WordPress plugin before version 0.9.133 does not sanitize a user-supplied list of identifiers before using it in a SQL query, allowing administrators to perform SQL injection attacks.

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files extracted from a backup package during restoration, allowing high privilege users such as administrators to write arbitrary files outside the intended restore directory, which can lead to code execution.