---
id: "CVE-2026-115241"
kind: "vulnerability"
aliases: ["CVE-2026-115241"]
title: "WPvivid WordPress plugin: admin can drop core database tables"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wpvivid"]
not_affected_if: ["plugin-not-installed", "version-0.9.137-or-later"]
published_at: "2026-11-04T06:17:01+00:00"
first_seen_at: "2026-11-04T06:25:18+00:00"
updated_at: "2026-11-04T06:26:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115241", "first_seen_at": "2026-11-04T06:25:18+00:00"}]
---

# WPvivid WordPress plugin: admin can drop core database tables

The WPvivid Backup, Migration and Staging WordPress plugin before 0.9.137 accepts a snapshot identifier without checking that it names a snapshot the plugin created, and uses it as a database table-name prefix. An authenticated administrator can supply the site's table prefix and make the plugin drop every matching table, including the core WordPress tables, which destroys the site's database.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed WPvivid version in the WordPress admin plugin list or the plugin's main file header; the sources do not name a fixed version beyond the 'before 0.9.137' range.
- Confirm whether the site has an administrator account that could be misused, since the flaw requires an authenticated administrator.

## Fix

- WPvivid Backup, Migration and Staging plugin: move to `0.9.137` or later.

## Timeline

- 2026-11-04T06:25:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115241

## From the sources

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not verify that a submitted snapshot identifier names a snapshot it actually created before using it as a database table-name prefix, so an authenticated administrator can supply the site's table prefix, or any other string, and cause the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 to drop every matching table, including the core WordPress tables, destroying the site's database.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_