{"id":"CVE-2026-115426","aliases":["EUVD-2026-116731","GHSA-2q5f-v38g-c39x"],"status":"published","title":"WPvivid Backup \u0026 Migration \u003c 0.9.138 - Admin+ Path Traversal via Local Backup Directory Setting","description":"The WPvivid — Backup, Migration \u0026 Staging WordPress plugin before 0.9.138 does not properly validate a backup storage directory path before using it to create directories and write files, allowing administrators to cause those directories and files to be created outside the intended backup location via path traversal.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00284,"percentile":0.21223,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2026-11-04T06:00:27Z","modified":"2026-11-04T14:18:20Z","products":[{"vendor":"unknown","product":"wpvivid — backup, migration \u0026 staging"},{"vendor":"wpvividplugins","product":"wpvivid — backup, migration \u0026 staging"}],"references":[{"url":"https://wpscan.com/vulnerability/c12a6832-81c3-4bae-93a9-3a51ff986863/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115426"},{"url":"https://wpscan.com/vulnerability/c12a6832-81c3-4bae-93a9-3a51ff986863"},{"url":"https://github.com/advisories/GHSA-2q5f-v38g-c39x"}],"sources":{"cve":[{"id":"CVE-2026-115426","title":"WPvivid Backup \u0026 Migration \u003c 0.9.138 - Admin+ Path Traversal via Local Backup Directory Setting","description":"The WPvivid — Backup, Migration \u0026 Staging WordPress plugin before 0.9.138 does not properly validate a backup storage directory path before using it to create directories and write files, allowing administrators to cause those directories and files to be created outside the intended backup location via path traversal.","status":"published","published":"2026-11-04T06:00:27.545Z","modified":"2026-11-04T14:18:20.062Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-04T15:32:52.167772Z"}],"euvd":[{"id":"EUVD-2026-116731","description":"The WPvivid — Backup, Migration \u0026 Staging WordPress plugin before 0.9.138 does not properly validate a backup storage directory path before using it to create directories and write files, allowing administrators to cause those directories and files to be created outside the intended backup location via path traversal.","status":"published","published":"2026-11-04T06:00:27Z","modified":"2026-11-04T14:18:20Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-04T15:09:08.966365Z"}],"ghsa":[{"id":"GHSA-2q5f-v38g-c39x","title":"The WPvivid — Backup, Migration \u0026 Staging WordPress plugin before 0.9.138 does not properly...","description":"The WPvivid — Backup, Migration \u0026 Staging WordPress plugin before 0.9.138 does not properly validate a backup storage directory path before using it to create directories and write files, allowing administrators to cause those directories and files to be created outside the intended backup location via path traversal.","status":"published","published":"2026-11-04T06:32:58Z","modified":"2026-11-04T15:32:29Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-04T15:52:09.418756Z"}],"nvd":[{"id":"CVE-2026-115426","description":"The WPvivid — Backup, Migration \u0026 Staging WordPress plugin before 0.9.138 does not properly validate a backup storage directory path before using it to create directories and write files, allowing administrators to cause those directories and files to be created outside the intended backup location via path traversal.","status":"published","published":"2026-11-04T06:17:02.23Z","modified":"2026-11-04T15:17:37.17Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-04T18:06:26.923818Z"}]}}