External risk intelligence

WPvivid Backup Plugin Log File Path Traversal Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-19725

The vulnerability exists in a WordPress plugin. WordPress sites are commonly deployed as public-facing web applications, making the plugin's functionality and its attack surface reachable over the internet by default.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in a popular WordPress plugin that allows for backups and migrations. This issue could enable an attacker to place files in unintended locations on a website, with potential implications for site integrity and data confidentiality. The primary concern at this time is to confirm if this plugin is in use and, if so, to understand the extent of its exposure.

Plugin allows attackers to write files anywhere.
Key to remember: attacker controls file location.
Executive takeaway: confirm plugin use and exposure.

Attack Path

How an attacker could exploit the issue

An attacker with administrative access to a WordPress site could leverage this vulnerability to create log files in any directory that the web server has permission to write to. By manipulating an unauthenticated request with a site transfer key, the attacker can specify a custom path for a log file, potentially overwriting critical files or placing malicious content in accessible locations, such as the web root. The vulnerability stems from the plugin's failure to properly sanitize input before constructing a file path.

Site transfer key required.
Unsanitized request input triggers log path creation.
Risk of arbitrary file creation and overwrite.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker with a site transfer key could leverage this vulnerability to write a log file to any writable directory within a WordPress site's file system. This capability is dependent on the site's configuration and the existence of a valid site transfer key.

Log files could be written anywhere.
Uses site transfer key for access.
Potential for unauthorized file creation.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and platform teams are likely responsible for addressing this vulnerability. The first practical step is to identify all WordPress sites utilizing the WPvivid plugin, confirm which are externally accessible or critical to business operations, and then assign ownership for remediation planning.

WordPress application owners
Verify plugin presence and reachability
Plan remediation based on risk

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WPvivid Backup, Migration & Staging plugin?

This is a WordPress plugin used by site administrators to automate backups, manage site migrations, and create staging environments for testing updates. It helps maintain site availability and data recovery by allowing users to move their site content between different hosting environments or create local copies for development.

How does CVE-2026-19725 work as a path traversal weakness?

The vulnerability is classified as CWE-22, Improper Limitation of a Pathname to a Restricted Directory. In this case, the plugin fails to sanitize user input when constructing file paths for its logs. This flaw allows an attacker to manipulate the file path destination, effectively directing the plugin to create a log file in unauthorized directories across the web server's file system.

Do I need a site-to-site transfer key to trigger this bug?

Yes, an attacker must possess a valid site-to-site transfer key to successfully exploit this vulnerability. Without this specific key, the request cannot be used to manipulate the log file path. Simply browsing or interacting with the site's public-facing features without this authentication credential will not trigger the file creation process.

Is my site at risk if it uses this plugin?

According to Halo Surface Signal, because this plugin is used in WordPress environments typically deployed as public-facing web applications, the attack surface is generally reachable over the internet. You should consider the plugin's presence as a factor if your site is externally accessible, as this increases the likelihood that an attacker could interact with the affected component.

How should I respond to this vulnerability?

Your first step is to perform an inventory of your WordPress installations to confirm if the WPvivid plugin is present. Once identified, prioritize sites that are externally facing or handle sensitive business operations. Coordinate with your application owners to plan for updates to version 0.9.131 or later, which contains the necessary security improvements to properly sanitize input.

References

wpscan.com/vulnerability/999889f4-f8be-4b44-b665-1a94df8d050d/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.