wpvividplugins WPvivid Plugin up to 0.9.131 on WordPress Export prepare_export_post export_data sql injection

Summaryinfo

A vulnerability identified as problematic has been detected in wpvividplugins WPvivid Plugin up to 0.9.131. This affects the function prepare_export_post of the component Export. Performing a manipulation of the argument export_data results in sql injection. This vulnerability was named CVE-2026-17555. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in wpvividplugins WPvivid Plugin up to 0.9.131. It has been classified as problematic. This affects the function prepare_export_post of the component Export. The manipulation of the argument export_data with an unknown input leads to a sql injection vulnerability. CWE is classifying the issue as CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The WPvivid Backup & Migration plugin for WordPress is vulnerable to SQL Injection via the export_data parameter in versions up to, and including, 0.9.131. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The values are received in prepare_export_post(), passed through sanitize_text_field() and stripslashes(), JSON-decoded, and the attacker-controlled JSON object keys are collected as $posts_ids without integer casting. They are stored in the export task options and later joined with commas and interpolated directly into a `WHERE ID IN (...)` clause inside a $wpdb->get_results() call in export_post_to_xml() (unquoted, numeric context), with no $wpdb->prepare() or esc_sql(). This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

The advisory is shared at wordfence.com. This vulnerability is uniquely identified as CVE-2026-17555 since 07/27/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Additional levels of successful authentication are necessary for exploitation. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/01/2026). MITRE ATT&CK project uses the attack technique T1505 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-51791). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• wpvividplugins

Name

• WPvivid Plugin

Version

• 0.9.131

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion