WordPress plugin
WPvivid — Backup, Migration & Staging security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 37 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical2
- High14
- Medium18
- Low3
All WPvivid — Backup, Migration & Staging vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | 0.9.136 - Authenticated (Administrator+) Arbitrary File Upload 0.9.117 – 0.9.136Update to 0.9.137 | CVE-2026-115243 | |
| High7.2 | Authenticated (Administrator+) Arbitrary File Upload <0.9.134Update to 0.9.134 | CVE-2026-82193 | |
| High7.2 | Authenticated (Administrator+) Remote Code Execution <0.9.133Update to 0.9.133 | CVE-2026-19722 | |
| High7.5 | Unauthenticated Path Traversal <0.9.131Update to 0.9.131 | CVE-2026-19725 | |
| Critical9.8 | Unauthenticated Arbitrary File Upload ≤0.9.123Update to 0.9.124 | CVE-2026-1357 | |
| High7.2 | Authenticated (Administrator+) Arbitrary File Upload ≤0.9.116Update to 0.9.117 | CVE-2025-5961 | |
| High7.2 | Authenticated (Admin+) Arbitrary File Upload via wpvivid_upload_file ≤0.9.112Update to 0.9.113 | CVE-2024-13869 | |
| High8.8 | Unauthenticated PHP Object Injection ≤0.9.107Update to 0.9.108 | CVE-2024-10962 | |
| High7.5 | Sensitive Information Exposure ≤0.9.105Update to 0.9.106 | CVE-2024-7315 | |
| High7.2 | Authenticated (Admin+) PHAR Deserialization ≤0.9.99Update to 0.9.100 | CVE-2024-3054 | |
| Critical9.8 | Unauthenticated SQL Injection 0.9.68 – 0.9.68Update to 0.9.69 | CVE-2024-1981 | |
| High8.0 | Google Drive Client Secret Exposure ≤0.9.91Update to 0.9.92 | CVE-2023-5576 | |
| High8.7 | Authenticated (Administrator+) Arbitrary Directory Deletion via Path Traversal 0.9.89 – 0.9.89Update to 0.9.90 | CVE-2023-4274 | |
| High8.3 | Missing Authorization via 'start_staging' and 'get_staging_progress' <0.9.91Update to 0.9.91 | CVE-2023-41243 | |
| High7.2 | Authenticated (Admin+) PHAR Deserialization ≤0.9.74Update to 0.9.75 | CVE-2022-2442 | |
| High8.8 | Authenticated (Subscriber+) Arbitrary File Upload ≤0.9.35Update to 0.9.36 | CVE-2020-36842 |
- High7.20.9.136 - Authenticated (Administrator+) Arbitrary File Upload
0.9.117 – 0.9.136Update to 0.9.137
- High7.2Authenticated (Administrator+) Arbitrary File Upload
<0.9.134Update to 0.9.134
- High7.2Authenticated (Administrator+) Remote Code Execution
<0.9.133Update to 0.9.133
- High7.5Unauthenticated Path Traversal
<0.9.131Update to 0.9.131
- Critical9.8Unauthenticated Arbitrary File Upload
≤0.9.123Update to 0.9.124
- High7.2Authenticated (Administrator+) Arbitrary File Upload
≤0.9.116Update to 0.9.117
- High7.2Authenticated (Admin+) Arbitrary File Upload via wpvivid_upload_file
≤0.9.112Update to 0.9.113
- High8.8Unauthenticated PHP Object Injection
≤0.9.107Update to 0.9.108
- High7.5Sensitive Information Exposure
≤0.9.105Update to 0.9.106
- High7.2Authenticated (Admin+) PHAR Deserialization
≤0.9.99Update to 0.9.100
- Critical9.8Unauthenticated SQL Injection
0.9.68 – 0.9.68Update to 0.9.69
- High8.0Google Drive Client Secret Exposure
≤0.9.91Update to 0.9.92
- High8.7Authenticated (Administrator+) Arbitrary Directory Deletion via Path Traversal
0.9.89 – 0.9.89Update to 0.9.90
- High8.3Missing Authorization via 'start_staging' and 'get_staging_progress'
<0.9.91Update to 0.9.91
- High7.2Authenticated (Admin+) PHAR Deserialization
≤0.9.74Update to 0.9.75
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
≤0.9.35Update to 0.9.36
WPvivid — Backup, Migration & Staging: common questions
Does WPvivid — Backup, Migration & Staging have known vulnerabilities?
Yes. VulnCrest Radar lists 37 known vulnerabilities in WPvivid — Backup, Migration & Staging: 2 critical, 14 high, 18 medium, 3 low. None are known to affect version null.
How do I check which version of WPvivid — Backup, Migration & Staging I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent WPvivid — Backup, Migration & Staging vulnerability?
CVE-2026-115426, published Nov 4, 2026: WPvivid — Backup, Migration & Staging < 0.9.138 - Authenticated (Administrator+) Path Traversal. Severity: Medium (CVSS 4.9).
Is any WPvivid — Backup, Migration & Staging vulnerability listed in CISA KEV?
No. None of the known WPvivid — Backup, Migration & Staging vulnerabilities is currently listed in the CISA KEV catalog.