Vulnerability in WPvivid — Backup, Migration & Staging — CVE-2026-115243

What to do now

Update WPvivid — Backup, Migration & Staging to 0.9.137 or later.

Affected versions

• 0.9.117 to 0.9.136 (inclusive)

The WPvivid — Backup, Migration & Staging plugin for WordPress is vulnerable to Arbitrary File Upload in versions 0.9.117 through 0.9.136. This is due to missing file type validation. This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files on the affected site's server, which may make remote code execution possible.

This description is reproduced verbatim from the public vulnerability record.

• https://www.wordfence.com/threat-intel/vulnerabilities/id/5e51b9cd-0e96-40e3-944e-e562ac7ae0b3?source=api-prod

Part of this record comes from Wordfence Intelligence. Original: https://www.wordfence.com/threat-intel/vulnerabilities/id/5e51b9cd-0e96-40e3-944e-e562ac7ae0b3
Copyright 2012-2026 Defiant Inc. / Full license text

This page is compiled automatically from public databases. Accuracy is not guaranteed; confirm against the vendor advisory before acting.