CVE-2022-2863— WPvivid Backup < 0.9.76 - Admin+ Arbitrary File Read
Quick assessment
Affected
Unknown Migration, Backup, Staging – WPvivid
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin Migration, Backup, Staging 0.9.76之前版本存在路径遍历漏洞，该漏洞源于在使用参数读取文件内容之前不会对参数进行清理和验证。攻击者利用该漏洞通过遍历攻击从web服务器读取任何文件。
Public Exploits 1
Nuclei · 1
CVE-2022-2863.yaml [template]
Possible ATT&CK Techniques 1 AI
T1083 · File and Directory Discovery
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-2863
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WPvivid Backup < 0.9.76 - Admin+ Arbitrary File Read
Source: CVE Program / CVE List V5
Vulnerability Description
The Migration, Backup, Staging WordPress plugin before 0.9.76 does not sanitise and validate a parameter before using it to read the content of a file, allowing high privilege users to read any file from the web server via a Traversal attack
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress plugin Migration, Backup, Staging 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin Migration, Backup, Staging 0.9.76之前版本存在路径遍历漏洞，该漏洞源于在使用参数读取文件内容之前不会对参数进行清理和验证。攻击者利用该漏洞通过遍历攻击从web服务器读取任何文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Migration, Backup, Staging – WPvivid | 0.9.76 ~ 0.9.76 | - |
|
II. Public POCs for CVE-2022-2863
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | WordPress WPvivid Backup version 0.9.76 is vulnerable to local file inclusion because the plugin does not sanitize and validate a parameter before using it to read the content of a file, allowing high privilege users to read any file from the web server. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2863.yaml | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-2863
请登录查看更多情报信息。
Vendor Advisories for CVE-2022-2863 (1)
Exploits & Public PoCs for CVE-2022-2863 (1)
Mailing List Discussions for CVE-2022-2863 (1)
-
http://seclists.org/fulldisclosure/2022/Oct/0 mailing-list
Same Patch Batch · Unknown · 2022-09-16 · 15 CVEs total
| CVE-2022-2913 | Login No Captcha reCAPTCHA < 1.7 - IP Check Bypass | |
| CVE-2022-2912 | Craw Data <= 1.0.0 - Server Side Request Forgery | |
| CVE-2022-2877 | Titan Anti-spam & Security < 7.3.1 - Protection Bypass due to IP Spoofing | |
| CVE-2022-2887 | WP Server Health Stats < 1.7.0 - Admin+ Stored Cross-Site Scripting | |
| CVE-2022-2799 | Affiliates Manager < 2.9.14 - Admin+ Stored Cross-Site Scripting | |
| CVE-2022-2798 | Affiliates Manager < 2.9.14 - Affiliate CSV Injection | |
| CVE-2022-2737 | WP STAGING < 2.9.18 - Admin+ Stored Cross-Site Scripting | |
| CVE-2022-2669 | WP Taxonomy Import <= 1.0.4 - Reflected Cross-Site Scripting | |
| CVE-2022-2654 | Classima < 2.1.11 - Reflected Cross-Site Scripting | |
| CVE-2022-2655 | Classified Listing Pro < 2.0.20 - Reflected Cross-Site Scripting | |
| CVE-2022-2635 | Autoptimize < 3.1.1 - Admin+ Stored Cross Site Scripting | |
| CVE-2022-2575 | WBW Currency Switcher for WooCommerce < 1.6.6 - Admin+ Stored XSS | |
| CVE-2022-2351 | Post SMTP < 2.1.4 - Admin+ Stored Cross-Site Scripting | |
| CVE-2022-1194 | Mobile Events Manager < 1.4.8 - Admin+ CSV Injection |
IV. Related Vulnerabilities
Same vendor: Unknown
-
CVE-2026-96173
Payments for Hubtel < 1.0.2 - Unauthenticated Order Key Disc -
CVE-2026-96200
Payments for Hubtel < 1.0.2 - Unauthenticated Payment Confir -
CVE-2026-96255
Payments for Hubtel < 1.0.2 - Unauthenticated Payment Gatewa -
CVE-2026-89296
Pro Like Button < 2.0 - Unauthenticated SQLi via 'postid' Pa -
CVE-2026-87973
If-So Dynamic Content 1.9.9 - 1.10.1 - Editor+ Stored XSS vi
Same weakness: CWE-22
-
CVE-2025-41753
Path traversal in dynamically created BACnet File Objects -
CVE-2026-103533
David-Crty databasement database-servers API Endpoint Restor -
CVE-2023-54403
Yonyou U8 CRM Arbitrary File Read via getemaildata.php -
CVE-2024-58387
Inspur HCM Cloud Arbitrary File Read via file/download Endpo -
CVE-2026-102116
Kiteworks Email Protection Gateway Path Traversal
V. Comments for CVE-2022-2863
No comments yet