EUVD-2026-59918
GHSA-567f-mvhw-x8w5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Reachable over network at low complexity but needs a valid site-to-site transfer key (PR:L); only fixed-content file placement, so no confidentiality impact and limited integrity (I:L).
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
5DescriptionCVE.org
The WPvivid - Backup, Migration & Staging WordPress plugin before 0.9.131 does not sanitise a value taken from an unauthenticated request before using it to build a log file path, allowing an attacker holding a site to site transfer key to create a log file in any existing writable directory of the site, including the web root.
The file name always carries a fixed suffix and the contents are always the WPvivid - Backup, Migration & Staging WordPress plugin before 0.9.131's own log header, so only the location of the file is attacker controlled.
AnalysisAI
Path traversal in the WPvivid - Backup, Migration & Staging WordPress plugin before 0.9.131 lets an attacker who possesses a valid site-to-site transfer key write a plugin-generated log file into any writable directory, including the web root, because an unsanitised value from the request is used to build the log file path. Publicly available exploit code exists (WPScan), but the impact is bounded: only the file's location is attacker-controlled while the filename suffix and the file contents (the plugin's own log header) are fixed, so this is arbitrary file placement rather than arbitrary content injection. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold a valid WPvivid site-to-site transfer key; the vulnerable code path is reachable from an unauthenticated HTTP request, but the transfer-key requirement is the real gating prerequisite and limits who can exploit it. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS 3.1 score is 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N), but this appears inflated relative to the described behaviour and should be treated with caution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained a valid site-to-site transfer key sends an unauthenticated request to the vulnerable endpoint containing directory-traversal sequences in the value used to build the log path. The plugin writes its standard log file, with its fixed suffix and header content, into the attacker-specified writable directory such as the web root. … |
| Remediation | Update the WPvivid - Backup, Migration & Staging plugin to version 0.9.131 or later, which is the vendor-released patched version that addresses the unsanitised log-path input. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Update WPvivid to version 0.9.131 or later via WordPress Admin > Plugins > Installed Plugins. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today