Vulnerability in Wpvivid — Backup, Migration & Staging

CVE-2026-19722

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files extracted from a backup package during restoration, allowing high privilege users such as administrators to write arbitrary files outside the intended restore directory, which can lead to code execution.

EPSS: 0.002 (6.7th percentile) — read the EPSS interpretation.

Affected products

  • Unknown Wpvivid — Backup, Migration & Staging

References