CVE-2026-115242 · Package
NO FIX YET · SEE WHAT TO DO
The WPvivid Backup, Migration and Staging WordPress plugin before 0.9.137 fails to sanitize the staging destination folder, so path traversal sequences are accepted. An authenticated administrator can make it write copied site files outside the WordPress installation directory.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Sites running the WPvivid Backup, Migration and Staging WordPress plugin before 0.9.137 are exposed when an administrator uses its staging feature. Only administrator-level accounts can trigger the flaw, so exposure depends on who holds admin rights on the site. Sites without WPvivid installed, or already on 0.9.137 or later, can skip it.
Not affected if no-admin-access-to-untrusted-users, plugin-not-installed, version-0.9.137-or-later
Who cares self-hosted, wordpress, wpvivid
wp plugin get wpvivid-backuprestore --field=version0.9.137 or laterThe WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not sanitize the staging destination folder supplied to its staging-start handler, applying only a generic text filter while the sibling writability-check handler applies the correct filename sanitizer, so an authenticated administrator can supply a path containing traversal sequences and make the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 write the copied site files outside the WordPress installation directory.
This page as .md · .json · in your agent: get_signal("CVE-2026-115242")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.