CVE-2025-12656: Migration, Backup, Staging – WPvivid Backup & Migration <= 0.9.128 - Authenticated (Admin+) Arbitrary Directory Deletion
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation in the deletecancelstagingsite() function in all versions up to, and including, 0.9.128. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary folders on the server, which leads to a loss of data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
WPvivid Backup & Migrationfrom your environment.Uninstall the WPvivid Backup & Migration plugin from all WordPress sites until a patched/fixed version is available.
- Compensating control
Restrict Administrator-level access: limit the number of admin accounts, review and remove untrusted admin users, and restrict administrative actions (e.g., plugin installation/activation) to trusted personnel or IP ranges.
- Operational
Check for evidence of deleted directories and file-system changes; restore any missing data from backups and verify site integrity using the most recent known-good backup.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12656?
The severity of CVE-2025-12656 is rated as low, with a score of 3.8.
How do I fix CVE-2025-12656?
To fix CVE-2025-12656, update the WPvivid Backup & Migration plugin to version 0.9.129 or later.
What systems are affected by CVE-2025-12656?
CVE-2025-12656 affects all versions of the WPvivid Backup & Migration plugin up to and including 0.9.128.
What type of vulnerability is CVE-2025-12656?
CVE-2025-12656 is classified as an arbitrary directory deletion vulnerability.
Who needs to be concerned about CVE-2025-12656?
Authenticated users with admin privileges using the affected WPvivid Backup & Migration plugin should be concerned about CVE-2025-12656.