CVE-2026-82194: CWE-73 External Control of File Name or Path in WPvivid — Backup, Migration & Staging

CVE-2026-82194 is an external control of file name or path vulnerability (CWE-73) in the WPvivid — Backup, Migration & Staging WordPress plugin. Versions prior to 0.9.134 do not properly validate user-supplied paths before using them in a file deletion function. This flaw allows users with administrator privileges to delete arbitrary files on the server, including those outside the web root directory, potentially impacting system availability.

The vulnerability allows an attacker with administrator privileges to delete arbitrary files on the server, which could disrupt service availability or cause data loss. There is no direct confidentiality impact reported. Integrity is impacted due to unauthorized file deletion. The CVSS score is 5.5 (medium severity) reflecting network attack vector, low complexity, required privileges of administrator, no user interaction, and impact on integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, restrict administrator access to trusted users only and monitor for suspicious file deletion activity related to the plugin.