{"id":"CVE-2026-115241","kind":"vulnerability","aliases":["CVE-2026-115241"],"related":[],"title":"WPvivid WordPress plugin: admin can drop core database tables","description":"The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not verify that a submitted snapshot identifier names a snapshot it actually created before using it as a database table-name prefix, so an authenticated administrator can supply the site's table prefix, or any other string, and cause the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 to drop every matching table, including the core WordPress tables, destroying the site's database.","summary":"The WPvivid Backup, Migration and Staging WordPress plugin before 0.9.137 accepts a snapshot identifier without checking that it names a snapshot the plugin created, and uses it as a database table-name prefix. An authenticated administrator can supply the site's table prefix and make the plugin drop every matching table, including the core WordPress tables, which destroys the site's database.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wpvivid"],"not_affected_if":["plugin-not-installed","version-0.9.137-or-later"],"how_to_check":"- Check the installed WPvivid version in the WordPress admin plugin list or the plugin's main file header; the sources do not name a fixed version beyond the 'before 0.9.137' range.\n- Confirm whether the site has an administrator account that could be misused, since the flaw requires an authenticated administrator.","fix":"- WPvivid Backup, Migration and Staging plugin: move to `0.9.137` or later.","status":"open","published_at":"2026-11-04T06:17:01+00:00","first_seen_at":"2026-11-04T06:25:18+00:00","triaged_at":"2026-11-04T06:26:20+00:00","updated_at":"2026-11-04T06:26:20+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T06:26:20Z","model":"claude-haiku-5-5","output":{"fix":"- WPvivid Backup, Migration and Staging plugin: move to `0.9.137` or later.","reach":"internet","title":"WPvivid WordPress plugin: admin can drop core database tables","impact":"high","summary":"The WPvivid Backup, Migration and Staging WordPress plugin before 0.9.137 accepts a snapshot identifier without checking that it names a snapshot the plugin created, and uses it as a database table-name prefix. An authenticated administrator can supply the site's table prefix and make the plugin drop every matching table, including the core WordPress tables, which destroys the site's database.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wpvivid","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Administrator drops all database tables, destroying the WordPress site","analyst_note":"","how_to_check":"- Check the installed WPvivid version in the WordPress admin plugin list or the plugin's main file header; the sources do not name a fixed version beyond the 'before 0.9.137' range.\n- Confirm whether the site has an administrator account that could be misused, since the flaw requires an authenticated administrator.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-0.9.137-or-later"],"who_is_affected":"Any WordPress site running the WPvivid Backup, Migration and Staging plugin before 0.9.137 is exposed. The attacker must already hold an administrator account on the site, so exposure depends on who has admin access. Sites without WPvivid installed, or already on 0.9.137 or later, are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000727,"input_tokens":4186,"output_tokens":616,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-115241':12A,15A '-2026':11A,14A '0.9.137':31B,93C,143C 'accept':32B 'actual':106C 'admin':4A 'administr':58B,121C 'authent':57B,120C 'backup':24B,87C,137C 'caus':134C 'check':37B 'core':7A,76B,151C 'creat':45B,107C 'cve':10A,13A 'databas':8A,51B,84B,113C,158C 'destroy':80B,154C 'drop':6A,70B,145C 'everi':71B,146C 'host':19B 'identifi':35B,101C 'includ':74B,149C 'make':67B 'match':72B,147C 'migrat':25B,88C,138C 'name':40B,54B,102C,116C 'packag':16B 'plugin':3A,29B,44B,69B,91C,141C 'prefix':55B,65B,117C,128C 'self':18B 'self-host':17B 'site':62B,82B,125C,156C 'snapshot':34B,42B,100C,104C 'stage':27B,89C,139C 'string':132C 'submit':99C 'suppli':60B,123C 'tabl':9A,53B,64B,73B,78B,115C,127C,148C,153C 'table-nam':52B,114C 'use':47B,109C 'verifi':96C 'without':36B 'wordpress':2A,20B,28B,77B,90C,140C,152C 'wpvivid':1A,21B,23B,86C,136C","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site running the WPvivid Backup, Migration and Staging plugin before 0.9.137 is exposed. The attacker must already hold an administrator account on the site, so exposure depends on who has admin access. Sites without WPvivid installed, or already on 0.9.137 or later, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","selfhosted","wordpress","wpvivid"],"campaign_type":null,"first_public_at":"2026-11-04T06:17:01+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115241","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115241","severity":null,"published_at":"2026-11-04T06:17:01+00:00","modified_at":"2026-11-04T06:17:01+00:00","first_seen_at":"2026-11-04T06:25:18+00:00","fetched_at":"2026-11-04T06:25:18+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}