CVE-2026-19722
NONE—CVSS v3
—CVSS v2
0.17%
EPSS (exploit probability)
—CWE
Description
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files extracted from a backup package during restoration, allowing high privilege users such as administrators to write arbitrary files outside the intended restore directory, which can lead to code execution.
Affected routers (0)
No routers currently mapped to this CVE in our database.