---
id: "CVE-2026-115242"
kind: "vulnerability"
aliases: ["CVE-2026-115242"]
title: "WPvivid WordPress plugin: staging path traversal writes files outside WordPress directory"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wpvivid"]
not_affected_if: ["no-admin-access-to-untrusted-users", "plugin-not-installed", "version-0.9.137-or-later"]
published_at: "2026-11-04T06:17:01+00:00"
first_seen_at: "2026-11-04T06:25:18+00:00"
updated_at: "2026-11-04T06:26:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115242", "first_seen_at": "2026-11-04T06:25:18+00:00"}]
---

# WPvivid WordPress plugin: staging path traversal writes files outside WordPress directory

The WPvivid Backup, Migration and Staging WordPress plugin before 0.9.137 fails to sanitize the staging destination folder, so path traversal sequences are accepted. An authenticated administrator can make it write copied site files outside the WordPress installation directory.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed WPvivid plugin version in the WordPress admin plugin list or `wp plugin get wpvivid-backuprestore --field=version`
- Confirm whether the site uses the staging feature of the plugin

## Fix

- WPvivid plugin: upgrade to `0.9.137` or later

## Timeline

- 2026-11-04T06:25:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115242

## From the sources

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not sanitize the staging destination folder supplied to its staging-start handler, applying only a generic text filter while the sibling writability-check handler applies the correct filename sanitizer, so an authenticated administrator can supply a path containing traversal sequences and make the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 write the copied site files outside the WordPress installation directory.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_