WPvivid Plugin CVE-2026-19722

Exploitation requires an authenticated WordPress administrator account - the CVSS PR:H metric confirms high privilege is mandatory, and lower-privileged roles (subscriber, editor, author, contributor) cannot trigger the vulnerable code path. The WPvivid plugin must be installed and active on the target site. The vulnerability is triggered specifically during a backup restoration operation when a specially crafted archive with path traversal sequences in filenames is submitted. What limits exploitation: administrator credentials are required (not unauthenticated), the attacker must be able to initiate a restore operation within the WordPress admin interface, and the malicious archive must be available for the restore operation. The vulnerability cannot be exploited passively or via remote unauthenticated access - direct administrative interaction is the trigger.

The CVSS 3.1 vector CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L scores 6.6 Medium, primarily constrained by the PR:H requirement and the Low individual impact ratings. The scope change (S:C) reflects that files can be written beyond the plugin's own directory space, affecting the broader WordPress installation. Notably, the Low integrity rating in the provided CVSS understates the practical impact: arbitrary file write to a web-accessible path is effectively a code execution primitive, and I:L appears conservative given the described behavior. EPSS at 0.17% (7th percentile) and SSVC 'Exploitation: none' both indicate no observed widespread exploitation, and SSVC 'Automatable: no' reflects that exploitation requires deliberate administrator-level interaction rather than passive scanning. However, a public POC from WPScan increases the practical risk over time. SSVC Technical Impact is rated 'partial,' consistent with the scoped nature of the write primitive. The realistic threat scenario is a compromised or insider-threat administrator account rather than opportunistic external exploitation.

An attacker who has obtained valid WordPress administrator credentials - via credential stuffing, phishing, or an insider threat - crafts a backup archive containing file entries with path traversal sequences (e.g., '../../../../wp-content/uploads/shell.php'). Initiating a restore of this archive through the WPvivid plugin interface causes the server to write the embedded PHP webshell to the web-accessible uploads directory without validation. The attacker then sends an HTTP request to the webshell URL to achieve remote code execution on the underlying server. A public POC is available via WPScan, which documents the exploitation technique.