CVE-2026-115242

Name of the Vulnerable Software and Affected Versions WPvivid — Backup, Migration & Staging WordPress plugin versions prior to 0.9.137

Description An issue exists where the plugin fails to properly sanitize the staging destination folder provided to the staging-start handler. While the writability-check handler uses a correct filename sanitizer, the staging-start handler only applies a generic text filter. This allows an authenticated administrator to use path traversal sequences—a technique used to access files and directories outside the intended folder—to write copied site files outside the WordPress installation directory.

Recommendations Update the plugin to version 0.9.137 or later.