Read the docs
TI-2026-84959 Aliases CVE-2026-115242GHSA-799w-j885-wg7g

Path traversal in WPvivid staging writes files outside WordPress

Priority LOW 25CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

The WPvivid Backup, Migration & Staging WordPress plugin before 0.9.137 does not sanitize the staging destination folder supplied to its staging-start handler. This is a path traversal flaw (CWE-22) that lets copied site files be written outside the WordPress installation directory. An authenticated administrator can trigger it. An exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not sanitize the staging destination folder supplied to its staging-start handler, applying only a generic text filter while the sibling writability-check handler applies the correct filename sanitizer, so an authenticated administrator can supply a path containing traversal sequences and make the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 write the copied site files outside the WordPress installation directory.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00284 21st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed WPvivid — Backup, Migration & Staging (Unknown): 0.9.137

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownWPvivid — Backup, Migration & Stagingbefore 0.9.1370.9.137Patch availableCNA
  • WPvivid — Backup, Migration & Staging VendorUnknown Affected before 0.9.137 Fixed in 0.9.137 Patch available CNA

Remediation

Update the WPvivid Backup, Migration & Staging plugin to version 0.9.137, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA WPvivid — Backup, Migration & Staging (Unknown) Fixed in 0.9.137

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    WPvivid — Backup, Migration & Staging 0.9.137

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-84960 Arbitrary file upload in WPvivid Backup & Migration pluginPriority LOW 31
    • TI-2026-84958 WPvivid plugin lets administrators drop any database tablePriority LOW 29
    Show all 3 records →

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-115242
  2. 2026-11-04 Alias added: GHSA-799w-j885-wg7g
  3. 2026-11-04 CVSS score added · CISA ADP
  4. 2026-11-04 Weakness changed · CISA ADP
  5. 2026-11-04 CISA SSVC decision points changed

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences