CVE-2026-19725: WPvivid Backup & Migration < 0.9.131 - Unauthenticated Path Traversal via send_to_site_connect
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131 does not sanitise a value taken from an unauthenticated request before using it to build a log file path, allowing an attacker holding a site to site transfer key to create a log file in any existing writable directory of the site, including the web root.
The file name always carries a fixed suffix and the contents are always the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131's own log header, so only the location of the file is attacker controlled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WPvivid — Backup, Migration & Staging WordPress pluginto a version that resolves this vulnerability.Fixed in 0.9.131 - Compensating control
If you cannot immediately upgrade, restrict network access to the vulnerable WPvivid functionality so an attacker cannot submit the unauthenticated request that triggers the path traversal (e.g., block access to any endpoint/URL used by the send_to_site_connect flow at the web/application firewall or via an IP allowlist).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19725?
The severity of CVE-2026-19725 is rated as 40.
How do I fix CVE-2026-19725?
To fix CVE-2026-19725, update the WPvivid Backup & Migration plugin to version 0.9.131 or later.
What type of vulnerability is CVE-2026-19725?
CVE-2026-19725 is categorized as an unauthenticated path traversal vulnerability.
What are the potential impacts of CVE-2026-19725?
CVE-2026-19725 may allow attackers to create log files in writable directories, potentially leading to information disclosure.
What WordPress plugin is affected by CVE-2026-19725?
The affected plugin is the WPvivid Backup & Migration plugin before version 0.9.131.