CVE-2026-19725 in WPvivid Plugin
Summary
by MITRE • 08/16/2026
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131 does not sanitise a value taken from an unauthenticated request before using it to build a log file path, allowing an attacker holding a site to site transfer key to create a log file in any existing writable directory of the site, including the web root.
The file name always carries a fixed suffix and the contents are always the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131's own log header, so only the location of the file is attacker controlled.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/16/2026
This vulnerability exists within the WPvivid — Backup, Migration & Staging WordPress plugin version 0.9.131 and earlier, where insufficient input sanitization occurs in the handling of unauthenticated requests. The flaw specifically manifests when processing a site transfer key that allows an attacker with access to this credential to manipulate file path construction for log file creation. The vulnerability stems from the plugin's failure to properly validate or sanitize user-supplied input before incorporating it into filesystem operations, creating a path traversal condition that enables arbitrary file placement within the WordPress installation directory structure.
The technical implementation of this vulnerability involves the plugin's use of an unauthenticated request parameter that directly influences log file path construction without adequate sanitization measures. When a legitimate site transfer key is presented, the system accepts and processes this value to determine where to store log files, but fails to validate that the specified path remains within acceptable boundaries. This creates an environment where attackers can specify directory paths that extend beyond intended locations, potentially placing log files in writable directories including the web root or other critical areas of the filesystem. The vulnerability is classified as a path traversal issue with characteristics aligning with CWE-23 and CWE-73, where insufficient input validation leads to unauthorized file system access.
The operational impact of this vulnerability extends beyond simple file placement, as attackers can leverage the predictable naming convention and fixed content structure to potentially disrupt normal operations or create persistence mechanisms. While the filename always includes a fixed suffix and log contents follow the plugin's standard header format, the attacker-controlled path allows for strategic placement of files that could facilitate further attacks. The vulnerability enables an attacker with a site transfer key to effectively place malicious files in writable directories, potentially including web-accessible locations where they could be executed or used to establish backdoors. This represents a significant risk within the context of the ATT&CK framework under the Initial Access and Persistence phases, as it allows for unauthorized file placement that could serve as a foundation for more extensive compromise.
The primary mitigation strategy involves implementing proper input validation and sanitization for all user-supplied parameters before they are used in filesystem operations. The plugin should validate that any path specified for log file creation remains within the intended directory structure and reject any attempts to traverse outside of authorized paths. Additionally, the site transfer key mechanism should be reviewed to ensure it properly validates access rights and implements appropriate rate limiting or session controls to prevent abuse. Security measures including proper file permissions, restricted write access to critical directories, and regular monitoring for unauthorized file creation should also be implemented. The vulnerability highlights the importance of defense in depth strategies where multiple layers of security controls work together to prevent exploitation even when individual controls fail.