CVE-2026-115426: WPvivid Backup & Migration < 0.9.138 - Admin+ Path Traversal via Local Backup Directory Setting
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.138 does not properly validate a backup storage directory path before using it to create directories and write files, allowing administrators to cause those directories and files to be created outside the intended backup location via path traversal.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress administrator can exploit it. The issue requires high privileges and does not require user interaction.
Are sites using the affected plugin exposed by default?
Exploitation depends on an administrator setting a crafted local backup storage directory path. The provided information does not indicate that the default backup directory configuration is vulnerable without such a change.
What is the impact of successful exploitation?
An administrator can use path traversal to cause directories and files to be created outside WPvivid's intended backup location. The stated impact is limited to integrity and availability; no confidentiality impact is listed.
What should be checked while patching is pending?
Review WPvivid local backup directory settings for paths containing traversal sequences or locations outside the intended backup area. Also inspect for unexpected directories or files created outside the approved backup location.