CVE-2026-19725

creationtimestamp| type| source ---|---|--- 2026-08-17 22:10:03+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtcprcy4lw2t...

CVE-2026-19725 WPvivid Backup & Migration < 0.9.131 - Unauthenticated Path Traversal via send_to_site_connect

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131 does not sanitise a value taken from an unauthenticated request before using it to build a log file path, allowing an attacker holding a site to site transfer key to create a log file in any existing writable directory of t...