CVE-2026-115242: WPvivid Backup & Migration < 0.9.137 - Admin+ Path Traversal via Staging Site Path
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not sanitize the staging destination folder supplied to its staging-start handler, applying only a generic text filter while the sibling writability-check handler applies the correct filename sanitizer, so an authenticated administrator can supply a path containing traversal sequences and make the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 write the copied site files outside the WordPress installation directory.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WPvivid Backup & Migrationto a version that resolves this vulnerability.Fixed in 0.9.137
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated as a WordPress administrator. The vulnerable staging-start handler can then be used to provide a destination folder containing path-traversal sequences.
What is the impact of successful exploitation?
The attacker can cause copied site files to be written outside the WordPress installation directory. The listed impact includes low integrity and availability effects, with no confidentiality impact indicated.
Are default installations affected?
The affected condition is use of the plugin's staging functionality with a destination folder supplied to the staging-start handler. The provided data does not state whether this functionality is enabled or reachable in a default configuration.
What version should be used to remediate the issue?
Update WPvivid Backup & Migration to version 0.9.137 or later. Versions before 0.9.137 are affected.