---
id: "CVE-2026-115426"
kind: "vulnerability"
aliases: ["CVE-2026-115426"]
title: "WPvivid backup plugin: path traversal lets admins write files outside backup folder"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wpvivid"]
not_affected_if: ["plugin-0.9.138-or-later", "plugin-not-installed"]
published_at: "2026-11-04T06:17:02+00:00"
first_seen_at: "2026-11-04T06:25:19+00:00"
updated_at: "2026-11-04T06:26:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115426", "first_seen_at": "2026-11-04T06:25:19+00:00"}]
---

# WPvivid backup plugin: path traversal lets admins write files outside backup folder

The WPvivid WordPress backup plugin before 0.9.138 does not validate the backup storage directory path. An administrator can make it create directories and write files outside the intended backup location.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed WPvivid plugin version in the WordPress admin Plugins page, or look for the plugin header `Version:` in `wp-content/plugins/wpvivid-backuprestore/wpvivid-backuprestore.php`.
- Confirm whether the backup storage directory setting has been changed from the default.

## Fix

- WPvivid Backup, Migration & Staging: `0.9.138` or later

## Timeline

- 2026-11-04T06:25:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115426

## From the sources

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.138 does not properly validate a backup storage directory path before using it to create directories and write files, allowing administrators to cause those directories and files to be created outside the intended backup location via path traversal.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_