Directory Traversal Vulnerability in WPvivid Backup, Migration & Staging Plugin
CVE-2026-115242

Currently unrated

Key Information:

Vendor

WordPress
Status
WPvivid — Backup, Migration & Staging
Vendor
CVE Published:
4 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-115242?

The WPvivid Backup, Migration & Staging WordPress plugin before version 0.9.137 contains a directory traversal vulnerability due to improper sanitization of user-provided input for the staging destination folder. An authenticated administrator can exploit this weakness by providing a path with traversal sequences, allowing them to write copied site files outside the intended WordPress installation directory. This flaw could lead to unauthorized file access and manipulation, posing significant security risks to the affected WordPress instance.

Affected Version(s)

WPvivid — Backup, Migration & Staging 0 < 0.9.137

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-115242 - Proof of Concept

References

https://wpscan.com/vulnerability/29ffe47f-a95a-46ec-bb7d-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Karthik Ramakrishnan
WPScan
.