CVE-2026-19725

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131 does not sanitise a value taken from an unauthenticated request before using it to build a log file path, allowing an attacker holding a site to site transfer key to create a log file in any existing writable directory of t...

CVE-2026-19725

The CVE concerns the WPvivid — Backup, Migration & Staging WordPress plugin (versions before 0.9.131). The issue stems from failing to sanitize a value taken from an unauthenticated request when building a log file path. As a result, an attacker who possesses a site-to-site transfer key can cause...