PT-2026-47066 · Wpvividplugins · Wpvivid — Backup

Chokri Hammedi · Published 2026-06-05 · Updated 2026-06-06 · CVE-2025-12656

NVD

CVSS v3.1

3.8

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation in the delete cancel staging site() function in all versions up to, and including, 0.9.128. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary folders on the server, which leads to a loss of data.

Fix

Weakness Enumeration

CWE-73

Related Identifiers

CVE-2025-12656

Affected Products

Wpvivid — Backup

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-12656 · Security Note
• https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/tags/0.9.120/includes/staging/class-wpvivid-staging.php#L1282 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3556022%40wpvivid-backuprestore&new=3556022%40wpvivid-backuprestore&sfp_email=&sfph_mail= · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/2f5962e5-3dc7-4f93-889c-d5e3530c7dba?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/tags/0.9.120/includes/staging/class-wpvivid-staging.php#L1268 · Note
• https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/tags/0.9.120/includes/staging/class-wpvivid-staging.php#L1296 · Note
• https://wordpress.org/plugins/wpvivid-backuprestore · Note