CVE-2026-115241: WPvivid Backup & Migration < 0.9.137 - Admin+ Arbitrary Database Table Deletion via Snapshot ID
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not verify that a submitted snapshot identifier names a snapshot it actually created before using it as a database table-name prefix, so an authenticated administrator can supply the site's table prefix, or any other string, and cause the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 to drop every matching table, including the core WordPress tables, destroying the site's database.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WPvivid — Backup, Migration & Staging WordPress pluginto a version that resolves this vulnerability.Fixed in 0.9.137
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress administrator is required. The attack can be performed remotely and does not require user interaction.
What conditions make a site vulnerable?
Sites using WPvivid Backup & Migration versions earlier than 0.9.137 are affected. An administrator can submit a snapshot identifier matching the site’s database table prefix or another chosen string.
What is the practical impact?
The attacker can cause matching database tables to be dropped, including core WordPress tables. This can destroy the site database and result in loss of integrity and availability.
How can I tell whether an instance may have been exploited?
Investigate unexpected missing database tables, especially WordPress core tables or groups of tables sharing a prefix. Database failures or a suddenly nonfunctional WordPress site may also indicate tables were deleted.