What is the CVSS score of CVE-2025-12656?

CVE-2025-12656 has a CVSS 3.1 base score of 3.8 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

WPvivid Backup Plugin CVE-2025-12656

EUVD-2025-210080 LOW

External Control of File Name or Path (CWE-73)

2026-06-06 security@wordfence.com

GHSA-vf58-f3g2-9cv9

Information Disclosure WordPress

3.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.8 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 00:27 vuln.today

CVE Published

Jun 06, 2026 - 00:16 nvd

LOW 3.8

DescriptionCVE.org

The Migration, Backup, Staging - WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation in the delete_cancel_staging_site() function in all versions up to, and including, 0.9.128. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary folders on the server, which leads to a loss of data.

AnalysisAI

Arbitrary directory deletion in the WPvivid Backup & Migration WordPress plugin (all versions through 0.9.128) allows authenticated administrators to remove arbitrary server-side folders by submitting a crafted path to the delete_cancel_staging_site() function. Impact is confined to integrity and availability - server files and directories can be irreversibly destroyed - with no confidentiality exposure. No public exploit identified at time of analysis, and exploitation requires high-privilege WordPress credentials, substantially limiting real-world risk.

Technical ContextAI

CWE-73 (External Control of File Name or Path) describes the root cause: the delete_cancel_staging_site() function in the plugin's staging management class (class-wpvivid-staging.php, lines ~1268-1296) accepts user-supplied path input without adequate canonicalization or boundary enforcement. A valid path traversal sequence in the staging site identifier can escape the intended staging directory scope and reference arbitrary directories on the underlying filesystem. The affected code is present in the wpvivid-backuprestore plugin installed via the WordPress plugin ecosystem; no CPE string was supplied, but the canonical plugin slug is wpvivid-backuprestore, available at wordpress.org/plugins/wpvivid-backuprestore/.

RemediationAI

Update the WPvivid Backup & Migration plugin to a version beyond 0.9.128. An upstream fix is referenced in the plugin repository changeset 3556022 (https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3556022%40wpvivid-backuprestore&new=3556022%40wpvivid-backuprestore), however the exact first patched release version is not independently confirmed from the available data - verify via the WordPress plugin changelog at https://wordpress.org/plugins/wpvivid-backuprestore/ before deploying. As a compensating control while patching is pending, restrict WordPress Administrator role assignments to the minimum required personnel and audit existing admin accounts for legitimacy; this directly reduces the pool of potential exploiters. Disabling the staging site feature in WPvivid settings eliminates the vulnerable code path entirely, though it removes staging functionality as a trade-off. File-system-level permissions hardening (ensuring the web process cannot delete directories outside the web root) provides defense-in-depth against this class of path traversal impact.