{"id":"CVE-2026-115242","kind":"vulnerability","aliases":["CVE-2026-115242"],"related":[],"title":"WPvivid WordPress plugin: staging path traversal writes files outside WordPress directory","description":"The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not sanitize the staging destination folder supplied to its staging-start handler, applying only a generic text filter while the sibling writability-check handler applies the correct filename sanitizer, so an authenticated administrator can supply a path containing traversal sequences and make the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 write the copied site files outside the WordPress installation directory.","summary":"The WPvivid Backup, Migration and Staging WordPress plugin before 0.9.137 fails to sanitize the staging destination folder, so path traversal sequences are accepted. An authenticated administrator can make it write copied site files outside the WordPress installation directory.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wpvivid"],"not_affected_if":["no-admin-access-to-untrusted-users","plugin-not-installed","version-0.9.137-or-later"],"how_to_check":"- Check the installed WPvivid plugin version in the WordPress admin plugin list or `wp plugin get wpvivid-backuprestore --field=version`\n- Confirm whether the site uses the staging feature of the plugin","fix":"- WPvivid plugin: upgrade to `0.9.137` or later","status":"open","published_at":"2026-11-04T06:17:01+00:00","first_seen_at":"2026-11-04T06:25:18+00:00","triaged_at":"2026-11-04T06:26:19+00:00","updated_at":"2026-11-04T06:26:19+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T06:26:19Z","model":"claude-haiku-5-5","output":{"fix":"- WPvivid plugin: upgrade to `0.9.137` or later","reach":"internet","title":"WPvivid WordPress plugin: staging path traversal writes files outside WordPress directory","impact":"medium","summary":"The WPvivid Backup, Migration and Staging WordPress plugin before 0.9.137 fails to sanitize the staging destination folder, so path traversal sequences are accepted. An authenticated administrator can make it write copied site files outside the WordPress installation directory.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wpvivid","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"administrator writes files outside the WordPress directory on the server","analyst_note":"","how_to_check":"- Check the installed WPvivid plugin version in the WordPress admin plugin list or `wp plugin get wpvivid-backuprestore --field=version`\n- Confirm whether the site uses the staging feature of the plugin","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-0.9.137-or-later","no-admin-access-to-untrusted-users"],"who_is_affected":"Sites running the WPvivid Backup, Migration and Staging WordPress plugin before 0.9.137 are exposed when an administrator uses its staging feature. Only administrator-level accounts can trigger the flaw, so exposure depends on who holds admin rights on the site. Sites without WPvivid installed, or already on 0.9.137 or later, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000714,"input_tokens":4191,"output_tokens":590,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-115242':14A,17A '-2026':13A,16A '0.9.137':33B,70C,124C 'accept':46B 'administr':49B,106C 'appli':85C,98C 'authent':48B,105C 'backup':26B,64C,118C 'check':96C 'contain':111C 'copi':54B,127C 'correct':100C 'cve':12A,15A 'destin':39B,76C 'directori':11A,61B,134C 'fail':34B 'file':8A,56B,129C 'filenam':101C 'filter':90C 'folder':40B,77C 'generic':88C 'handler':84C,97C 'host':21B 'instal':60B,133C 'make':51B,115C 'migrat':27B,65C,119C 'outsid':9A,57B,130C 'packag':18B 'path':5A,42B,110C 'plugin':3A,31B,68C,122C 'sanit':36B,73C,102C 'self':20B 'self-host':19B 'sequenc':44B,113C 'sibl':93C 'site':55B,128C 'stage':4A,29B,38B,66C,75C,82C,120C 'staging-start':81C 'start':83C 'suppli':78C,108C 'text':89C 'travers':6A,43B,112C 'wordpress':2A,10A,22B,30B,59B,67C,121C,132C 'wpvivid':1A,23B,25B,63C,117C 'writability-check':94C 'writabl':95C 'write':7A,53B,125C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WPvivid Backup, Migration and Staging WordPress plugin before 0.9.137 are exposed when an administrator uses its staging feature. Only administrator-level accounts can trigger the flaw, so exposure depends on who holds admin rights on the site. Sites without WPvivid installed, or already on 0.9.137 or later, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","wordpress","wpvivid"],"campaign_type":null,"first_public_at":"2026-11-04T06:17:01+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115242","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115242","severity":null,"published_at":"2026-11-04T06:17:01+00:00","modified_at":"2026-11-04T06:17:01+00:00","first_seen_at":"2026-11-04T06:25:18+00:00","fetched_at":"2026-11-04T06:25:18+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}