The WPvivid Backup & Migration plugin for WordPress (versions <=0.9.131) is vulnerable to SQL Injection through the export_data parameter. The vulnerability stems from insufficient escaping and lack of parameterized queries in the export_post_to_xml() function, where attacker-controlled JSON object keys are collected and directly interpolated into a SQL WHERE clause without integer casting or use of $wpdb->prepare() or esc_sql(). This allows authenticated administrators to append additional SQL commands to extract sensitive data from the database. The vulnerability is tracked as CVE-2026-17555 with a CVSS 3.1 base score of 4.9 (medium severity). No known exploits in the wild or vendor patches have been reported as of the publication date.

An authenticated user with Administrator-level access or higher can exploit this vulnerability to perform SQL Injection attacks. This can lead to unauthorized disclosure of sensitive information from the WordPress database. The vulnerability does not affect confidentiality, integrity, or availability beyond data disclosure. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Administrator-level access to trusted users only and monitor for suspicious activity related to export tasks. Avoid using the vulnerable export_data functionality if possible.