PT-2026-47066 · WordPress · Wpvivid Backup/Migration

Chokri Hammedi · CVE-2025-12656 · Published 2026-06-05 · Updated 2026-06-13

Positive Technologies (AI Summary)

CVSS v3.1

3.8

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions WPvivid Backup & Migration versions prior to 0.9.129

Description The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress allows authenticated attackers with Administrator-level access and above to delete arbitrary folders on the server. This issue is caused by insufficient file path validation within the delete cancel staging site() function, which can lead to significant data loss.

Recommendations Update to version 0.9.129 or later. As a temporary workaround, restrict access to the delete cancel staging site() function to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-73

Related Identifiers

CVE-2025-12656

Affected Products

Wpvivid Backup/Migration

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-12656 · Security Note
• https://t.me/CVEtracker/56027 · Telegram Post
• https://t.me/cveNotify/166309 · Telegram Post
• https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/tags/0.9.120/includes/staging/class-wpvivid-staging.php#L1268 · Note
• https://twitter.com/atomicedgeWAF/status/2065785276614508612 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3556022%40wpvivid-backuprestore&new=3556022%40wpvivid-backuprestore&sfp_email=&sfph_mail= · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/2f5962e5-3dc7-4f93-889c-d5e3530c7dba?source=cve · Note
• https://wordpress.org/plugins/wpvivid-backuprestore · Note
• https://twitter.com/infoflowcloud/status/2063584643824189555 · Twitter Post
• https://twitter.com/CVEnew/status/2063584099059609855 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/tags/0.9.120/includes/staging/class-wpvivid-staging.php#L1282 · Note
• https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/tags/0.9.120/includes/staging/class-wpvivid-staging.php#L1296 · Note