PT-2026-136864

CVE-2026-115426

Published

2026-11-04

Updated

2026-11-04

Description by

CVSS 3.1

5.5

Medium

MetricsAV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions WPvivid — Backup, Migration & Staging WordPress plugin versions prior to 0.9.138

Description Insufficient validation of user-supplied paths allows authenticated users with administrator-level access to perform path traversal. This occurs when the plugin fails to properly validate a backup storage directory path before using it to create directories and write files, enabling the creation of files and directories outside the intended backup location.

Recommendations Update the plugin to version 0.9.138 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Karthik Ramakrishnan

Vendors

Affected products

Weakness enumeration

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')

Related identifiers