CVE-2025-12656: CWE-73 External Control of File Name or Path in wpvividplugins WPvivid — Backup, Migration & Staging
The WPvivid Backup, Migration & Staging WordPress plugin contains a vulnerability in the delete_cancel_staging_site() function that allows authenticated administrators to delete arbitrary directories on the server due to insufficient file path validation. This affects all versions up to and including 0.9.128. The vulnerability can lead to loss of data on the affected server. The CVSS score is 3.8, indicating a low severity level.
AI Analysis
Technical Summary
CVE-2025-12656 is an external control of file name or path vulnerability (CWE-73) in the WPvivid Backup, Migration & Staging plugin for WordPress. The issue exists in the delete_cancel_staging_site() function, which does not properly validate file paths before deleting directories. Authenticated users with Administrator privileges can exploit this to delete arbitrary folders on the server, potentially causing data loss. The vulnerability affects all versions up to and including 0.9.128. There is no official patch or remediation level provided in the available data.
Potential Impact
An attacker with Administrator-level access can delete arbitrary directories on the server, resulting in loss of data. There is no indication of confidentiality or integrity impact beyond deletion. The low CVSS score reflects the requirement for high privileges and the limited scope of impact.
Mitigation Recommendations
No official patch or remediation has been confirmed as of the provided data. Users should restrict Administrator access to trusted personnel only and monitor for suspicious activity. Check the vendor advisory regularly for updates or patches addressing this vulnerability.
CVE-2025-12656: CWE-73 External Control of File Name or Path in wpvividplugins WPvivid — Backup, Migration & Staging
Description
The WPvivid Backup, Migration & Staging WordPress plugin contains a vulnerability in the delete_cancel_staging_site() function that allows authenticated administrators to delete arbitrary directories on the server due to insufficient file path validation. This affects all versions up to and including 0.9.128. The vulnerability can lead to loss of data on the affected server. The CVSS score is 3.8, indicating a low severity level.
CVSS v3.1
Score 3.8low
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-12656 is an external control of file name or path vulnerability (CWE-73) in the WPvivid Backup, Migration & Staging plugin for WordPress. The issue exists in the delete_cancel_staging_site() function, which does not properly validate file paths before deleting directories. Authenticated users with Administrator privileges can exploit this to delete arbitrary folders on the server, potentially causing data loss. The vulnerability affects all versions up to and including 0.9.128. There is no official patch or remediation level provided in the available data.
Potential Impact
An attacker with Administrator-level access can delete arbitrary directories on the server, resulting in loss of data. There is no indication of confidentiality or integrity impact beyond deletion. The low CVSS score reflects the requirement for high privileges and the limited scope of impact.
Mitigation Recommendations
No official patch or remediation has been confirmed as of the provided data. Users should restrict Administrator access to trusted personnel only and monitor for suspicious activity. Check the vendor advisory regularly for updates or patches addressing this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2025-11-03T20:41:36.992Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a236054e29bf47b50d6f26c
Added to database: 06/05/2026, 23:48:36 UTC
Last enriched: 06/13/2026, 09:55:12 UTC
Last updated: 07/31/2026, 19:22:53 UTC
Views: 65
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.