CVE-2026-115241 · Package
NO FIX YET · SEE WHAT TO DO
The WPvivid Backup, Migration and Staging WordPress plugin before 0.9.137 accepts a snapshot identifier without checking that it names a snapshot the plugin created, and uses it as a database table-name prefix. An authenticated administrator can supply the site's table prefix and make the plugin drop every matching table, including the core WordPress tables, which destroys the site's database.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Any WordPress site running the WPvivid Backup, Migration and Staging plugin before 0.9.137 is exposed. The attacker must already hold an administrator account on the site, so exposure depends on who has admin access. Sites without WPvivid installed, or already on 0.9.137 or later, are not affected.
Not affected if plugin-not-installed, version-0.9.137-or-later
Who cares self-hosted, wordpress, wpvivid
0.9.137 or later.The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not verify that a submitted snapshot identifier names a snapshot it actually created before using it as a database table-name prefix, so an authenticated administrator can supply the site's table prefix, or any other string, and cause the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 to drop every matching table, including the core WordPress tables, destroying the site's database.
This page as .md · .json · in your agent: get_signal("CVE-2026-115241")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.