Veille CVE

Recherche « Unknown WPvivid — Backup, Migration & Staging »

5 CVE

Critique 1 Élevée 0 Moyenne 4 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown WPvivid — Backup, Migration & Staging » ✕
  1. CVE-2026-82194 5.5 Moyenne

    Unknown WPvivid — Backup, Migration & Staging

    The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied path before using it in a file deletion routine, allowing administrators to delete arbitrary files on the server, including files outside the web root.

  2. CVE-2026-82193 5.5 Moyenne

    Unknown WPvivid — Backup, Migration & Staging

    The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrators to write files of permitted types to arbitrary locations on the server and to overwrite existing files.

  3. CVE-2026-82182 4.1 Moyenne

    Unknown WPvivid — Backup, Migration & Staging

    The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not sanitise a user supplied list of identifiers before using it in a SQL query, allowing administrators to perform SQL injection attacks.

  4. CVE-2026-19722 6.6 Moyenne

    Unknown WPvivid — Backup, Migration & Staging

    The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files extracted from a backup package during restoration, allowing high privilege users such as administrators to write arbitrary files outside the intended restore directory, which can lead to code execution.

  5. CVE-2026-19725 9.1 Critique

    Unknown WPvivid — Backup, Migration & Staging

    The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131 does not sanitise a value taken from an unauthenticated request before using it to build a log file path, allowing an attacker holding a site to site transfer key to create a log file in any existing writable directory of the site, including the web root. The file name always carries a fixed suffix and the contents are always the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131's own log header, so only the location of the file is attacker controlled.