Now officially on WordPress.org

CVE Database / CVE-2026-19725

CVE

CVE-2026-19725 — WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.131

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2026-19725 WPvivid — Backup, Migration & Staging [wpvivid-backuprestore] < 0.9.131 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Unknown < 0.9.131 0.9.131 2026-08-16 —

CVE-2026-19725

The WPvivid Backup plugin fails to properly validate user input when generating log file paths, enabling an attacker with a site transfer key to craft a malicious log file path that can be written to any directory on the site, including the web root, by exploiting the plugin's lack of input sanitization. This vulnerability allows the attacker to control the location of the log file, which can lead to unintended consequences.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings