EUVD-2026-69860
GHSA-9jvm-6p58-6wcf
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Admin-only network-reachable SQLi; S:C retained for potential cross-schema DB access; I:L added since SQL injection primitives enable data writes, not only reads.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The WPvivid - Backup, Migration & Staging WordPress plugin before 0.9.133 does not sanitise a user supplied list of identifiers before using it in a SQL query, allowing administrators to perform SQL injection attacks.
AnalysisAI
SQL injection in the WPvivid Backup, Migration & Staging WordPress plugin (all versions before 0.9.133) allows authenticated WordPress administrators to inject arbitrary SQL through an unsanitized list of identifiers passed directly to database queries. The CVSS scope change (S:C) indicates injected queries may reach beyond the plugin's own data, potentially touching other schemas on the shared MySQL host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress administrator account (the highest default WordPress role, distinct from editor, author, or subscriber). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The overall risk is constrained by the PR:H requirement - only accounts holding the full WordPress administrator role can trigger the injection, excluding editors, authors, subscribers, and unauthenticated visitors. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the WPvivid Backup, Migration & Staging plugin to version 0.9.133 or later using the WordPress admin panel under Plugins > Updates or by downloading directly from the WordPress plugin repository. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Path traversal in the WPvivid - Backup, Migration & Staging WordPress plugin before 0.9.131 lets an attacker who possess
Arbitrary file write via path traversal in the WPvivid - Backup, Migration & Staging WordPress plugin (versions before 0
Arbitrary file-write via path traversal in WPvivid - Backup, Migration & Staging WordPress plugin before 0.9.134 allows
Arbitrary file deletion in WPvivid - Backup, Migration & Staging WordPress plugin before 0.9.134 allows authenticated ad
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today