EUVD-2026-70911
GHSA-jhr7-3vcm-f87v
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L
Admin-authenticated path traversal enabling deletion of any server file warrants I:H and A:H on the broader system, not Low, as critical OS or app files can be destroyed.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The WPvivid - Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied path before using it in a file deletion routine, allowing administrators to delete arbitrary files on the server, including files outside the web root.
AnalysisAI
Arbitrary file deletion in WPvivid - Backup, Migration & Staging WordPress plugin before 0.9.134 allows authenticated administrators to supply unsanitized path values to the plugin's file deletion routine, enabling deletion of files anywhere on the server filesystem including outside the web root. Exploitation requires WordPress administrator credentials but no other conditions, and a publicly available proof-of-concept has been published by WPScan. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress administrator account on the target installation - the CVSS vector confirms PR:H (high privileges). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 5.5 with vector AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L understates the practical impact: while the numeric score is moderate, the scope change to the broader server filesystem means an authenticated admin could delete wp-config.php, SSH authorized_keys, cron jobs, or system binaries - effectively bricking the server or enabling privilege escalation through strategic file removal. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the WPvivid - Backup, Migration & Staging plugin to version 0.9.134 or later via the WordPress admin dashboard or the WordPress plugin repository. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Path traversal in the WPvivid - Backup, Migration & Staging WordPress plugin before 0.9.131 lets an attacker who possess
Arbitrary file write via path traversal in the WPvivid - Backup, Migration & Staging WordPress plugin (versions before 0
Arbitrary file-write via path traversal in WPvivid - Backup, Migration & Staging WordPress plugin before 0.9.134 allows
SQL injection in the WPvivid Backup, Migration & Staging WordPress plugin (all versions before 0.9.133) allows authentic
Same weakness CWE-73 – External Control of File Name or Path
View allShare
External POC / Exploit Code
Leaving vuln.today