CVE-2026-115426 in WPvivid Plugin
Summary
by MITRE • 11/04/2026
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.138 does not properly validate a backup storage directory path before using it to create directories and write files, allowing administrators to cause those directories and files to be created outside the intended backup location via path traversal.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in WPvivid Backup, Migration & Staging versions prior to 0.9.138 represents a critical failure in input validation regarding file system operations. This flaw is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal or directory traversal. The core technical issue stems from the plugin's handling of user-supplied data for backup storage configurations without sufficient sanitization or canonicalization checks. When an administrator configures a remote or local storage destination, the application accepts the provided file path and passes it directly to operating system functions responsible for creating directories and writing files. Because the input is not rigorously validated against expected directory structures, an attacker with administrative privileges can manipulate this parameter using relative paths such as dot-dot-slash sequences or absolute path overrides.
From a technical perspective, the exploitation of this vulnerability relies on the principle that web applications often run with elevated permissions to facilitate file management tasks like backups and migrations. By injecting maliciously crafted directory names into the storage configuration field, an attacker can force the application to create directories in arbitrary locations within the server's file system. This capability allows for the placement of files outside the designated backup root directory. While the vulnerability requires administrative access to trigger initially, it significantly expands the attack surface by allowing precise control over where data is written on the underlying operating system.
The operational impact of this flaw extends beyond simple unauthorized file creation. If an attacker can write arbitrary files to specific locations within the web server's document root or other sensitive directories, they may achieve remote code execution. For instance, writing a PHP shell script into a publicly accessible directory could allow full compromise of the WordPress installation and potentially the underlying host system. Furthermore, this vulnerability facilitates data exfiltration by enabling the storage of stolen database dumps or configuration files in locations that might be more easily accessed via direct URL requests if those directories are not properly secured against web access. It also undermines the integrity of backup systems, as backups could be stored in unpredictable locations, rendering recovery efforts unreliable and potentially leading to significant downtime during disaster recovery scenarios.
This vulnerability aligns with MITRE ATT&CK techniques related to persistence and privilege escalation through file system manipulation. Specifically, it relates to T1505: Server Software Component, where attackers install backdoors or malicious components by writing files to server directories. The lack of strict path validation also reflects common misconfigurations in web application frameworks that assume all input is safe when processed by standard library functions without explicit security checks.
To mitigate this vulnerability, organizations must immediately update the WPvivid plugin to version 0.9.138 or later, where the developers have implemented proper input sanitization and path canonicalization routines. Administrators should verify their server configurations to ensure that no sensitive files were written to unexpected locations during any period of exposure. Additionally, implementing strict file upload restrictions at the web server level, such as disabling script execution in directories intended for static data storage, can provide a layer of defense-in-depth against potential exploitation attempts derived from this flaw. Regular auditing of plugin permissions and adherence to the principle of least privilege when configuring backup destinations are essential practices to prevent similar issues in future deployments.