CVE-2026-82194 in WPvivid Plugin
Summary
by MITRE • 09/04/2026
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied path before using it in a file deletion routine, allowing administrators to delete arbitrary files on the server, including files outside the web root.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in WPvivid Backup, Migration & Staging versions prior to 0.9.134 represents a critical security flaw rooted in improper input validation within the plugin's file management operations. This issue is classified under CWE-22 as Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal or directory traversal. The core technical failure lies in the application's handling of user-supplied paths during file deletion routines. Instead of sanitizing or validating these inputs against an allowlist of permitted directories, the software directly incorporates them into system commands responsible for removing files from the server's filesystem. This lack of validation allows a malicious actor to manipulate the path parameter using standard traversal sequences such as dot-dot-slash characters to escape the intended directory scope and target arbitrary locations on the host machine.
The operational impact of this vulnerability is severe due to the privilege level required to exploit it. Since the flaw affects administrators, an attacker who has obtained administrative credentials for a WordPress site can leverage these privileges to execute destructive actions beyond the web root. While many vulnerabilities are limited to modifying files within the public_html or wp-content directories, this specific weakness permits deletion of system-critical files located outside the web-accessible area. This capability enables attackers to compromise server stability by removing essential configuration files, logs, or other operational data that supports the underlying operating system or hosting environment. The ability to delete arbitrary files effectively results in a denial of service condition and can lead to complete system failure if critical components are removed.
From an offensive security perspective, this vulnerability aligns with MITRE ATT&CK techniques related to Defense Evasion and Impact, specifically file deletion activities that disrupt availability. Attackers often utilize such flaws as part of a broader compromise strategy where initial access is gained through weak administrative credentials or other vulnerabilities in the WordPress ecosystem. Once inside, the ability to traverse directories and delete files outside the web root significantly increases the blast radius of the attack. It allows for deeper persistence mechanisms removal by defenders or more aggressive disruption tactics that are difficult to recover from without backups, which ironically may also be targeted given the nature of a backup plugin being compromised.
Mitigation strategies must focus on immediate remediation and future hardening practices. The primary solution is to upgrade the WPvivid Backup, Migration & Staging plugin to version 0.9.134 or later, where this input validation issue has been addressed by developers implementing strict path canonicalization and allowlisting mechanisms. Administrators should ensure that all plugins are kept up-to-date with security patches released by their vendors. Additionally, organizations should enforce the principle of least privilege for WordPress administrative accounts to limit the potential impact if credentials are compromised. Implementing web application firewalls can also provide a layer of detection for path traversal attempts, although relying solely on WAFs is not sufficient given that this vulnerability requires authenticated access. Regular audits of file permissions and monitoring for unexpected file deletions in system directories are recommended defensive measures to detect exploitation attempts early.