CVE-2026-82193: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in WPvivid — Backup, Migration & Staging

CVE-2026-82193 is a CWE-22 path traversal vulnerability in the WPvivid — Backup, Migration & Staging WordPress plugin. Versions prior to 0.9.134 do not properly validate user-supplied file names before using them to build file write paths. This allows users with administrator privileges to write files to arbitrary locations on the server, including overwriting existing files. The CVSS 3.1 base score is 5.5 (medium severity) with network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, no confidentiality impact, limited integrity impact, and low availability impact.

An attacker with administrator privileges can exploit this vulnerability to write files to arbitrary locations on the server, potentially overwriting critical files. This could lead to limited integrity and availability impacts on the affected system. There is no direct confidentiality impact reported. No known exploits are currently observed in the wild.

No official patch or remediation level has been confirmed as of the publication date. Users should upgrade to version 0.9.134 or later once available, as the vulnerability affects versions before 0.9.134. Until a fix is released, restrict administrator access to trusted users only and monitor for suspicious file writes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.