EUVD-2026-51791
GHSA-5c57-362f-vw84
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Administrator credentials required (PR:H); exploit is network-delivered with no interaction needed; SQL injection yields read-only database access (C:H/I:N/A:N) with no scope change.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The WPvivid Backup & Migration plugin for WordPress is vulnerable to SQL Injection via the export_data parameter in versions up to, and including, 0.9.131. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The values are received in prepare_export_post(), passed through sanitize_text_field() and stripslashes(), JSON-decoded, and the attacker-controlled JSON object keys are collected as $posts_ids without integer casting. They are stored in the export task options and later joined with commas and interpolated directly into a WHERE ID IN (...) clause inside a $wpdb->get_results() call in export_post_to_xml() (unquoted, numeric context), with no $wpdb->prepare() or esc_sql(). This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
SQL injection in the WPvivid Backup & Migration WordPress plugin (versions ≤0.9.131) allows authenticated Administrators to extract arbitrary data from the WordPress database via a crafted export_data parameter. The flaw exists because JSON object keys supplied by the attacker pass through sanitize_text_field() and stripslashes() but are never integer-cast, allowing them to be stored and later interpolated unsanitized into a WHERE ID IN (...) SQL clause without wpdb->prepare() or esc_sql(). No public exploit or active exploitation has been identified; the Administrator privilege requirement substantially constrains real-world impact.
Technical ContextAI
The vulnerable code is in the WPvivid Backup & Migration plugin's export pipeline, specifically in prepare_export_post() (class-wpvivid-export-import.php L1129) and export_post_to_xml() (class-wpvivid-exporter.php L1398, L1409). The export_data parameter is received, passed through sanitize_text_field() and stripslashes(), then JSON-decoded. The attacker controls the keys of the decoded JSON object, which are collected into $posts_ids without integer casting - a critical omission since the SQL context is numeric (WHERE ID IN (...)). These unsanitized keys are stored in export task options and later joined with commas and interpolated directly into a $wpdb->get_results() call, bypassing WordPress's prepared statement API entirely. CWE-89 (Improper Neutralization of Special Elements in SQL Commands) captures the root cause: partial sanitization that addresses string-context injection but fails to enforce numeric type safety, creating a stored SQL injection pathway.
RemediationAI
Update the WPvivid Backup & Migration plugin to a version beyond 0.9.131. A fix has been committed to the plugin repository per changeset https://plugins.trac.wordpress.org/changeset?reponame=&old=3627791%40wpvivid-backuprestore&new=3627791%40wpvivid-backuprestore; however, the exact patched release version number is not independently confirmed from the provided data - verify the current stable release version via the WordPress plugin repository before upgrading. The correct fix requires integer-casting all collected $posts_ids values before SQL interpolation, or wrapping the query with $wpdb->prepare(). As a compensating control prior to patching, restrict WordPress Administrator role assignment to the minimum necessary personnel and enforce strong, unique credentials with multi-factor authentication on admin accounts - this eliminates the attacker's prerequisite access. Disabling the plugin's export functionality via WordPress hooks is a more aggressive but disruptive compensating measure if patching is delayed.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today