CVE-2026-115426 · Package
NO FIX YET · SEE WHAT TO DO
The WPvivid WordPress backup plugin before 0.9.138 does not validate the backup storage directory path. An administrator can make it create directories and write files outside the intended backup location.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Sites running the WPvivid WordPress plugin before 0.9.138. Exploitation requires an administrator account, so sites that limit admin access and do not use the plugin can skip it. unknown whether a non-default configuration is required.
Not affected if plugin-0.9.138-or-later, plugin-not-installed
Who cares self-hosted, wordpress, wpvivid
Version: in wp-content/plugins/wpvivid-backuprestore/wpvivid-backuprestore.php.0.9.138 or laterThe WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.138 does not properly validate a backup storage directory path before using it to create directories and write files, allowing administrators to cause those directories and files to be created outside the intended backup location via path traversal.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.