CVE-2026-19722 in WPvivid Plugin
Summary
by MITRE • 08/30/2026
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files extracted from a backup package during restoration, allowing high privilege users such as administrators to write arbitrary files outside the intended restore directory, which can lead to code execution.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/30/2026
The vulnerability identified in WPvivid Backup, Migration & Staging versions prior to 0.9.133 represents a critical path traversal and unrestricted file write flaw within the plugin's backup restoration mechanism. This security defect stems from an insufficient validation of destination paths when processing archives submitted for restoration. Specifically, the application fails to sanitize or canonicalize the file paths contained within the uploaded backup package before extracting them to the server filesystem. Consequently, if a malicious actor constructs a ZIP archive containing files with relative path traversal sequences such as dot-dot-slash sequences in their filenames, the extraction process will resolve these paths against the intended restore directory but ultimately write the files to arbitrary locations on the web server's file system. This behavior bypasses the expected containment boundaries of the WordPress installation directories, allowing an attacker to place executable scripts or configuration files outside the protected scope of the application.
From a technical perspective, this flaw is classified under CWE-22 Improper Limitation of a Pathname to a Restricted Directory and CWE-434 Unrestricted Upload of File with Dangerous Type. The root cause lies in the lack of strict path normalization checks prior to file system operations. When the plugin iterates through the entries of an archive, it does not verify that each entry's resolved absolute path remains within the designated target directory. This oversight allows for directory traversal attacks where the attacker manipulates the internal structure of the backup package to escape the sandboxed restore area. In environments where PHP execution is enabled in directories outside the standard WordPress wp-content or uploads folders, this capability becomes particularly severe as it facilitates direct code injection into locations that may be directly accessible via HTTP requests without requiring further authentication for file access.
The operational impact of this vulnerability is significant due to its privilege requirements and potential consequences. The attack vector requires a high-privilege user account, such as an Administrator or Editor with upload capabilities, which aligns with the ATT&CK technique T1505.003 Server Software Component: Web Shell. An authenticated attacker can exploit this flaw by uploading a crafted backup archive that includes a PHP web shell file located in a path like ../../wp-config.php.bak or directly into the root public directory as index.php if permissions allow. Once written, these files can be executed via standard HTTP requests, leading to complete compromise of the underlying server and all hosted applications on that instance. This effectively grants the attacker full control over the web application's data, including database credentials stored in configuration files, user session tokens, and sensitive business logic.
Mitigation strategies for this vulnerability primarily involve immediate software updates and strict access controls. The most effective remediation is to upgrade WPvivid Backup, Migration & Staging to version 0.9.133 or later, where the developers have implemented proper path validation checks during the extraction process. Administrators should ensure that file upload permissions are restricted to only necessary directories and that PHP execution is disabled in any writable user-uploaded directories using web server configuration directives such as deny execute permissions for specific MIME types or directory blocks. Additionally, implementing a Web Application Firewall can provide an additional layer of defense by detecting and blocking requests associated with known path traversal patterns or suspicious file uploads containing executable code signatures. Regular auditing of installed plugins and limiting the number of users with administrative privileges further reduces the attack surface available to potential exploiters seeking to leverage this flaw for unauthorized access.