CVE-2026-19722: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in WPvivid — Backup, Migration & Staging

The WPvivid — Backup, Migration & Staging WordPress plugin versions prior to 0.9.133 do not properly validate the destination paths of files extracted from backup packages during restoration. This path traversal flaw (CWE-22) enables users with high privileges to write files outside the designated restore directory, potentially allowing arbitrary code execution on the affected system.

An attacker with administrator privileges can exploit this vulnerability to write arbitrary files outside the intended directory during backup restoration. This can lead to code execution, compromising the integrity and availability of the affected system. The CVSS score of 6.6 indicates a medium severity impact with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted users only and avoid restoring untrusted backup packages.