CVE-2026-115241Medium· 6.5▾ SunlitThe WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not verify that a submitted snapshot identifier names a snapshot it actually created before using it as a database table-name prefix, so an authenticated admi…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the CISA ADP record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.1%
0.1% → 0.3%
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not verify that a submitted snapshot identifier names a snapshot it actually created before using it as a database table-name prefix, so an authenticated administrator can supply the site's table prefix, or any other string, and cause the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 to drop every matching table, including the core WordPress tables, destroying the site's database.
wpvivid_backup_migration_staging < 0.9.137Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115242Medium· 5.5WPvivid Backup & Migration < 0.9.137 - Admin+ Path Traversal via Staging Site Path
CVE-2026-115243Medium· 6.7WPvivid Backup & Migration 0.9.117 - 0.9.136 - Admin+ Arbitrary File Upload via wpvivid_upload_import_files
CVE-2026-115426Medium· 5.5WPvivid Backup & Migration < 0.9.138 - Admin+ Path Traversal via Local Backup Directory Setting
CVE-2025-49707High· 7.9Azure Virtual Machines Spoofing Vulnerability
CVE-2025-24840Medium· 5.8Improper access control for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
CVE-2025-48734High· 8.8Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2