CVE-2026-82182: CWE-89 SQL Injection in WPvivid — Backup, Migration & Staging

CVE-2026-82182 describes a SQL injection vulnerability (CWE-89) in the WPvivid — Backup, Migration & Staging WordPress plugin versions prior to 0.9.133. The flaw arises because the plugin does not properly sanitize a user-supplied list of identifiers before incorporating them into a SQL query. This improper input validation enables users with administrator privileges to execute SQL injection attacks. The vulnerability has a CVSS 3.1 base score of 4.1, indicating medium severity, with network attack vector, low attack complexity, and no user interaction required. The impact is limited to confidentiality loss without integrity or availability impact. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

An attacker with administrator privileges can exploit this vulnerability to perform SQL injection attacks, potentially leading to unauthorized disclosure of information from the database. The CVSS score indicates limited impact to confidentiality only, with no impact on integrity or availability. No active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution with plugin usage and restrict administrative access to trusted users only. Monitor for vendor updates regarding patches or mitigations.