The WPvivid Backup, Migration & Staging plugin for WordPress contains an arbitrary directory deletion vulnerability (CWE-73) in the delete_cancel_staging_site() function due to insufficient file path validation. Authenticated users with Administrator privileges can exploit this flaw to delete arbitrary folders on the server, leading to data loss. This affects all versions up to and including 0.9.128. The vulnerability has a CVSS 3.1 base score of 3.8, reflecting low severity with network attack vector, low complexity, high privileges required, no user interaction, and impact limited to integrity and availability.

An attacker with Administrator-level access can delete arbitrary directories on the server hosting the WordPress site, causing loss of data and potential disruption of service. There is no impact on confidentiality or data disclosure. The vulnerability requires high privileges and does not involve user interaction. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator access to trusted users only and monitor for suspicious activity related to directory deletions. Avoid using vulnerable versions of the plugin if possible.