---
id: CVE-2026-115426
title: >-
  WPvivid Backup & Migration < 0.9.138 - Admin+ Path Traversal via Local Backup
  Directory Setting
summary: >-
  The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.138 does
  not properly validate a backup storage directory path before using it to
  create directories and write files, allowing administrators to cause those
  directorie…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L'
cvssSource: adp
cwe:
  - CWE-22
product: 'WPvivid — Backup, Migration & Staging'
affected:
  - wpvivid_backup_migration_staging < 0.9.138
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-04T14:02:32.151618Z'
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T14:18:20.062Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115426'
references:
  - url: 'https://wpscan.com/vulnerability/c12a6832-81c3-4bae-93a9-3a51ff986863/'
tags:
  - cve.org
epss: 0.00284
epssPercentile: 0.21071
ingestedAt: '2026-11-05T21:36:00.363Z'
---

## Overview

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.138 does not properly validate a backup storage directory path before using it to create directories and write files, allowing administrators to cause those directories and files to be created outside the intended backup location via path traversal.

## Affected

- `wpvivid_backup_migration_staging < 0.9.138`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.