WordPress Plugin Vulnerabilities

WPvivid Backup & Migration < 0.9.134 - Admin+ Arbitrary File Deletion via Path Traversal

Description

The plugin does not validate a user supplied path before using it in a file deletion routine, allowing administrators to delete arbitrary files on the server, including files outside the web root.

Proof of Concept

Affects Plugins

Plugin icon
wpvivid-backuprestore
Fixed in 0.9.134

References

CVE
CVE-2026-82194

Classification

Type
FILE DELETION
OWASP top 10
A6: Security Misconfiguration
CWE
CWE-73
CVSS
5.5 (medium)

Miscellaneous

Original Researcher
Meher Sudhakar Abbireddi
Submitter
Meher Sudhakar Abbireddi
Verified
Yes
WPVDB ID
bb68f7ae-e380-4154-bd77-8511d8f949d3

Timeline

Publicly Published
2026-09-02 (about 2 days ago)
Added
2026-09-02 (about 1 day ago)
Last Updated
2026-09-02 (about 1 day ago)

Other

Published
Title
Published
2023-12-26
Title
Media File Renamer < 5.7.8 - Admin+ Remote Code Execution
Published
2026-03-20
Title
Task Manager <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Read
Published
2025-04-07
Title
ZoomSounds - WordPress Wave Audio Player with Playlist <= 6.91 - Unauthenticated Arbitrary File Download
Published
2025-05-16
Title
WPBot Pro Wordpress Chatbot < 13.7.0 - Authenticated (Subscriber+) Arbitrary File Deletion
Published
2025-12-05
Title
10Web Booster < 2.32.11 - Subscriber+ Arbitrary Folder Deletion