The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied path before using it in a file deletion routine, allowing administrators to delete arbitrary files on the server, including files outside the web root.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 04 Sep 2026 06:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied path before using it in a file deletion routine, allowing administrators to delete arbitrary files on the server, including files outside the web root. | |
| Title | WPvivid Backup & Migration < 0.9.134 - Admin+ Arbitrary File Deletion via Path Traversal | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2026-09-04T06:00:05.079Z
Reserved: 2026-08-28T07:51:22.016Z
Link: CVE-2026-82194
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-09-04T07:17:10.840
Modified: 2026-09-04T07:17:10.840
Link: CVE-2026-82194
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
No weakness.