WPvivid Backup & Migration < 0.9.131 Unauthenticated Path Traversal via send_to_site_connect (CVE-2026-19725)

Vulnerability Overview Vulnerability Name: WPvivid Backup & Migration < 0.9.131 - Unauthenticated Path Traversal via send_to_site_connect Description: This plugin fails to sanitize values received from unauthenticated requests. An attacker can exploit this vulnerability to create log files in any writable directory on the website, including the web root. The filenames always contain a fixed suffix, and the content is consistently the plugin's log header; therefore, the attacker controls the file location. CVE ID: CVE-2026-19725 Type: Path Traversal (TRAVERSAL) OWASP Top 10: A1: Injection CWE: CWE-22 CVSS Score: 3.7 (Low) Affected Range Affected Plugin: wpvivid-backuprestore Fixed Version: 0.9.131 Remediation Fixed Version: Upgrade to version 0.9.131 or higher. Timeline Public Disclosure Date: 2026-08-14 Add Date: 2026-08-14 Last Updated Date: 2026-08-14 Additional Information Original Researcher: Nir Yehoshua Submitter: Nir Yehoshua Submitter Website: https://ciphersecuritylabs.com/ Submitter Twitter: niryebo Validation Status: Yes WPVDB ID: 999889f4-f8be-4b44-b665-1a94df8d050d Related Vulnerabilities WordPress Download Manager < 3.1.25 - Authenticated Directory Traversal atec Debug < 1.2.23 - Admin+ Arbitrary File Deletion Custom Fields for WooCommerce < 1.5.1 - Unauthenticated Arbitrary File Deletion via Path Traversal Ajax Load More < 5.5.4 - Admin+ Arbitrary File Read Images Optimize and Upload CF7 < 2.2.1 - Unauthenticated Arbitrary File Deletion POC Code POC Code: Specific POC code is not provided in the page, but it is mentioned that the POC will be demonstrated on August 28, 2026, to give users time to update.

Goal Reached Thanks to every supporter — we hit 100%!

WPvivid Backup & Migration < 0.9.131 Unauthenticated Path Traversal via send_to_site_connect (CVE-2026-19725)

More from this source