[ CVE-2026-115242 · Published 4 Nov 2026 ]
Vulnerability in Unknown WPvivid — Backup, Migration & Staging
CVSS 5.5
EPSS <1%No fix listed yet
[ Description ]Official description
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not sanitize the staging destination folder supplied to its staging-start handler, applying only a generic text filter while the sibling writability-check handler applies the correct filename sanitizer, so an authenticated administrator can supply a path containing traversal sequences and make the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 write the copied site files outside the WordPress installation directory.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.