CVE-2026-19725: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in WPvivid — Backup, Migration & Staging
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131 does not sanitise a value taken from an unauthenticated request before using it to build a log file path, allowing an attacker holding a site to site transfer key to create a log file in any existing writable directory of the site, including the web root. The file name always carries a fixed suffix and the contents are always the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131's own log header, so only the location of the file is attacker controlled.
AI Analysis
Technical Summary
The WPvivid — Backup, Migration & Staging WordPress plugin versions prior to 0.9.131 do not properly sanitize input taken from unauthenticated requests when constructing a log file path. This improper limitation of a pathname to a restricted directory (CWE-22) enables an attacker possessing a site-to-site transfer key to create log files in arbitrary writable directories on the server, including the web root. Although the file content is fixed and controlled by the plugin, the attacker can influence the file's location, potentially leading to security risks such as unauthorized file creation or overwriting.
Potential Impact
An attacker with a site-to-site transfer key can create files in arbitrary writable directories, including the web root, which may facilitate further attacks such as web shell deployment or unauthorized file manipulation. The vulnerability has a CVSS score of 9.1 (critical), indicating high impact on confidentiality and integrity, but no impact on availability. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the site-to-site transfer key and monitor for unauthorized use. Avoid exposing the transfer key to untrusted parties. Follow vendor updates closely for an official fix or temporary mitigation.
CVE-2026-19725: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in WPvivid — Backup, Migration & Staging
Description
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131 does not sanitise a value taken from an unauthenticated request before using it to build a log file path, allowing an attacker holding a site to site transfer key to create a log file in any existing writable directory of the site, including the web root. The file name always carries a fixed suffix and the contents are always the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131's own log header, so only the location of the file is attacker controlled.
CVSS v3.1
Score 9.1critical
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The WPvivid — Backup, Migration & Staging WordPress plugin versions prior to 0.9.131 do not properly sanitize input taken from unauthenticated requests when constructing a log file path. This improper limitation of a pathname to a restricted directory (CWE-22) enables an attacker possessing a site-to-site transfer key to create log files in arbitrary writable directories on the server, including the web root. Although the file content is fixed and controlled by the plugin, the attacker can influence the file's location, potentially leading to security risks such as unauthorized file creation or overwriting.
Potential Impact
An attacker with a site-to-site transfer key can create files in arbitrary writable directories, including the web root, which may facilitate further attacks such as web shell deployment or unauthorized file manipulation. The vulnerability has a CVSS score of 9.1 (critical), indicating high impact on confidentiality and integrity, but no impact on availability. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the site-to-site transfer key and monitor for unauthorized use. Avoid exposing the transfer key to untrusted parties. Follow vendor updates closely for an official fix or temporary mitigation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-08-13T12:24:20.804Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a8154acbf8831d53998d6f6
Added to database: 08/16/2026, 06:11:56 UTC
Last enriched: 08/23/2026, 13:16:32 UTC
Last updated: 09/06/2026, 22:52:08 UTC
Views: 62
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.