Vulnerability · Published Aug 16, 2026 · Assigned by WPScan

CVE-2026-19725WPvivid Backup & Migration < 0.9.131 - Unauthenticated Path Traversal via send_to_site_connect

Critical 9.1

In plain English

A critical-severity path traversal in WPvivid — Backup, Migration & Staging from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.5%top 55.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131 does not sanitise a value taken from an unauthenticated request before using it to build a log file path, allowing an attacker holding a site to site transfer key to create a log file in any existing writable directory of the site, including the web root. The file name always carries a fixed suffix and the contents are always the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131's own log header, so only the location of the file is attacker controlled.

Affected products (as reported)

Vendor	Product	Versions
Unknown	WPvivid — Backup, Migration & Staging	0 – before 0.9.131

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

https://wpscan.com/vulnerability/999889f4-f8be-4b44-b665-1a94df8d050d/ exploit, vdb-entry, technical-description