WordPress Plugin Vulnerabilities

WPvivid Backup & Migration < 0.9.129 - Admin+ Arbitrary Directory Deletion

Description

The plugin is vulnerable to arbitrary directory deletion due to insufficient file path validation in the `delete_cancel_staging_site()` function, allowing authenticated attackers with Administrator-level access and above to delete arbitrary folders on the server, leading to loss of data.

Affects Plugins

Plugin icon
wpvivid-backuprestore
Fixed in 0.9.129

References

CVE
CVE-2025-12656
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/2f5962e5-3dc7-4f93-889c-d5e3530c7dba

Classification

Type
FILE DELETION
OWASP top 10
A6: Security Misconfiguration
CWE
CWE-73
CVSS
3.8 (low)

Miscellaneous

Original Researcher
blue0x1
Verified
No
WPVDB ID
8d60707a-f405-4283-a4d0-bba905c62c95

Timeline

Publicly Published
2026-06-05 (about 3 months ago)
Added
2026-06-05 (about 3 months ago)
Last Updated
2026-06-05 (about 3 months ago)

Other

Published
Title
Published
2025-11-20
Title
WP AUDIO GALLERY <= 2.0 - Authenticated (Subscriber+) Arbitrary File Deletion via 'audio_upload' Parameter
Published
2022-11-30
Title
Easy WP SMTP < 1.5.2 - Admin+ Arbitrary File Deletion
Published
2022-08-03
Title
Download Manager < 3.2.51 - Contributor+ Arbitrary File Deletion
Published
2026-09-10
Title
Code Monkeys Proposals <= 1.0.1 - Subscriber+ Arbitrary File Deletion via Path Traversal
Published
2025-03-19
Title
Order Export & Order Import for WooCommerce < 2.6.1 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function