CVE-2026-115426: medium-severity vulnerability in WPvivid — Backup, Migration & Staging
WPvivid Backup & Migration < 0.9.138 - Admin+ Path Traversal via Local Backup Directory Setting
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.5epss 0.2%
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.138 does not properly validate a backup storage directory path before using it to create directories and write files, allowing administrators to cause those directories and files to be created outside the intended backup location via path traversal.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L
Affected products
Unknown · WPvivid — Backup, Migration & Stagingpublic PoCs found — 1
cve_referencewpscan.com/vulnerability/c12a6832-81c3-4bae-93a9-3a51ff986863/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — WPvivid — Backup, Migration & Staging
In the same product, most dangerous first.
CVE-2026-19725CRITICALWPvivid Backup & Migration < 0.9.131 - Unauthenticated Path Traversal via send_to_site_connectEPSS 0.5%CVE-2026-19722MEDIUMWPvivid Backup & Migration < 0.9.133 - Admin+ Arbitrary File Write via Zip Slip in Backup RestoreEPSS 0.4%CVE-2026-82193MEDIUMWPvivid Backup & Migration < 0.9.134 - Admin+ File Write Outside the Backup Directory via Path TraversalEPSS 0.4%CVE-2026-82194MEDIUMWPvivid Backup & Migration < 0.9.134 - Admin+ Arbitrary File Deletion via Path TraversalEPSS 0.3%CVE-2026-82182MEDIUMWPvivid Backup & Migration < 0.9.133 - Admin+ SQLi via Upload Cleaner IsolationEPSS 0.3%CVE-2026-115242MEDIUMWPvivid Backup & Migration < 0.9.137 - Admin+ Path Traversal via Staging Site PathEPSS 0.2%