CVE-2026-82193: WPvivid Backup & Migration < 0.9.134 - Admin+ File Write Outside the Backup Directory via Path Traversal
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrators to write files of permitted types to arbitrary locations on the server and to overwrite existing files.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs administrator-level access to a WordPress site using a vulnerable version of the plugin. The available information does not indicate that lower-privileged users or unauthenticated visitors can exploit it.
What can a successful attacker do?
A malicious administrator can use a crafted file name containing path traversal sequences to write permitted file types outside the plugin's backup directory. This can overwrite existing files at arbitrary server locations where the WordPress process has write permission.
Which versions should be remediated?
WPvivid Backup & Migration versions earlier than 0.9.134 are affected. Update the plugin to version 0.9.134 or later.