CVE-2026-17555
Received Received - Intake

SQL Injection in WPvivid Backup & Migration Plugin

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: Wordfence

Description
The WPvivid Backup & Migration plugin for WordPress is vulnerable to SQL Injection via the export_data parameter in versions up to, and including, 0.9.131. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The values are received in prepare_export_post(), passed through sanitize_text_field() and stripslashes(), JSON-decoded, and the attacker-controlled JSON object keys are collected as $posts_ids without integer casting. They are stored in the export task options and later joined with commas and interpolated directly into a `WHERE ID IN (...)` clause inside a $wpdb->get_results() call in export_post_to_xml() (unquoted, numeric context), with no $wpdb->prepare() or esc_sql(). This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-17555
EUVD
EUVD-2026-51791

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpvivid backup_and_migration to 0.9.131 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a SQL Injection vulnerability in the WPvivid Backup & Migration WordPress plugin up to version 0.9.131. It occurs because user input in the export_data parameter is not properly sanitized or cast to integers before being used in a SQL query. Attackers with admin access can inject malicious SQL to extract sensitive database information.

Detection Guidance

Detection requires checking for unauthorized SQL queries or unusual database access patterns. Inspect WordPress logs for suspicious export_data parameter usage in WPvivid plugin requests. Look for JSON objects with non-numeric IDs in export tasks. Monitor database query logs for appended SQL statements in WHERE IN clauses.

Impact Analysis

If exploited, this vulnerability allows authenticated attackers with admin privileges to extract sensitive data from the WordPress database, including user credentials, site content, or other confidential information. It does not allow code execution or modification of data but poses a serious privacy risk.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using the affected plugin may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately update the WPvivid Backup & Migration plugin to the latest version. If an update is unavailable, disable the plugin until a patch is released. Restrict Administrator-level access to only necessary users. Review database logs for signs of exploitation and consider rolling back to a clean backup if compromised.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17555. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart