SQL Injection Risk in WPvivid Backup & Migration Plugin for WordPress

CVE-2026-17555

What is CVE-2026-17555?

The WPvivid Backup & Migration plugin for WordPress is susceptible to SQL Injection through the export_data parameter. This vulnerability arises from inadequate sanitization of user-supplied input and improper handling of SQL queries. Attackers, possessing Administrator-level access or higher, can exploit this weakness by inserting additional SQL queries into existing ones through arguments passed to the plugin's functions. Such exploitation can lead to unauthorized access to sensitive database information, emphasizing the need for immediate updates and robust security practices to mitigate this risk.

References