CVE-2026-17555

Name of the Vulnerable Software and Affected Versions WPvivid Backup & Migration versions prior to 0.9.132

Description Authenticated attackers with Administrator-level access and above can perform SQL Injection, a technique used to interfere with the queries that an application makes to its database. The issue occurs because the export data parameter is not properly escaped or prepared before being used in a SQL query. Specifically, values processed in prepare export post() are JSON-decoded and stored as $posts ids without integer casting. These values are later interpolated directly into a WHERE ID IN (...) clause within the export post to xml() function using $wpdb->get results(), bypassing necessary security functions like $wpdb->prepare() or esc sql(). This allows an attacker to append malicious SQL queries to extract sensitive information from the database.

Recommendations Update WPvivid Backup & Migration to a version newer than 0.9.131. As a temporary mitigation, restrict access to the export data parameter and the export post to xml() function to only the most trusted administrators.