{"id":"CVE-2026-115426","kind":"vulnerability","aliases":["CVE-2026-115426"],"related":[],"title":"WPvivid backup plugin: path traversal lets admins write files outside backup folder","description":"The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.138 does not properly validate a backup storage directory path before using it to create directories and write files, allowing administrators to cause those directories and files to be created outside the intended backup location via path traversal.","summary":"The WPvivid WordPress backup plugin before 0.9.138 does not validate the backup storage directory path. An administrator can make it create directories and write files outside the intended backup location.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wpvivid"],"not_affected_if":["plugin-0.9.138-or-later","plugin-not-installed"],"how_to_check":"- Check the installed WPvivid plugin version in the WordPress admin Plugins page, or look for the plugin header `Version:` in `wp-content/plugins/wpvivid-backuprestore/wpvivid-backuprestore.php`.\n- Confirm whether the backup storage directory setting has been changed from the default.","fix":"- WPvivid Backup, Migration & Staging: `0.9.138` or later","status":"open","published_at":"2026-11-04T06:17:02+00:00","first_seen_at":"2026-11-04T06:25:19+00:00","triaged_at":"2026-11-04T06:26:15+00:00","updated_at":"2026-11-04T06:26:15+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T06:26:15Z","model":"claude-haiku-5-5","output":{"fix":"- WPvivid Backup, Migration & Staging: `0.9.138` or later","reach":"internet","title":"WPvivid backup plugin: path traversal lets admins write files outside backup folder","impact":"medium","summary":"The WPvivid WordPress backup plugin before 0.9.138 does not validate the backup storage directory path. An administrator can make it create directories and write files outside the intended backup location.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wpvivid","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Administrator writes files outside backup directory on the server","analyst_note":"Confirm whether the flaw is exploitable by a non-admin or only by an administrator, and check the vendor changelog for the 0.9.138 fix.","how_to_check":"- Check the installed WPvivid plugin version in the WordPress admin Plugins page, or look for the plugin header `Version:` in `wp-content/plugins/wpvivid-backuprestore/wpvivid-backuprestore.php`.\n- Confirm whether the backup storage directory setting has been changed from the default.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-0.9.138-or-later"],"who_is_affected":"Sites running the WPvivid WordPress plugin before 0.9.138. Exploitation requires an administrator account, so sites that limit admin access and do not use the plugin can skip it. unknown whether a non-default configuration is required.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000702,"input_tokens":4112,"output_tokens":581,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-115426':15A,18A '-2026':14A,17A '0.9.138':31B,63C 'admin':7A 'administr':41B,83C 'allow':82C 'backup':2A,11A,28B,36B,53B,57C,69C,96C 'caus':85C 'creat':45B,77C,92C 'cve':13A,16A 'directori':38B,46B,71C,78C,87C 'file':9A,49B,81C,89C 'folder':12A 'host':22B 'intend':52B,95C 'let':6A 'locat':54B,97C 'make':43B 'migrat':58C 'outsid':10A,50B,93C 'packag':19B 'path':4A,39B,72C,99C 'plugin':3A,29B,61C 'proper':66C 'self':21B 'self-host':20B 'stage':59C 'storag':37B,70C 'travers':5A,100C 'use':74C 'valid':34B,67C 'via':98C 'wordpress':23B,27B,60C 'wpvivid':1A,24B,26B,56C 'write':8A,48B,80C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WPvivid WordPress plugin before 0.9.138. Exploitation requires an administrator account, so sites that limit admin access and do not use the plugin can skip it. unknown whether a non-default configuration is required.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","wordpress","wpvivid"],"campaign_type":null,"first_public_at":"2026-11-04T06:17:02+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115426","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115426","severity":null,"published_at":"2026-11-04T06:17:02+00:00","modified_at":"2026-11-04T06:17:02+00:00","first_seen_at":"2026-11-04T06:25:19+00:00","fetched_at":"2026-11-04T06:25:19+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}