CVE-2026-82194
Received Received - Intake

Arbitrary File Deletion in WPvivid Backup Plugin

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: WPScan

Description
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied path before using it in a file deletion routine, allowing administrators to delete arbitrary files on the server, including files outside the web root.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-82194
EUVD
EUVD-2026-70911

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wpvivid backup_migration_and_staging to 0.9.134 (exc)
wpvivid backup_migration to 0.9.134 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the WPvivid Backup, Migration & Staging WordPress plugin before version 0.9.134. It allows authenticated administrators to delete arbitrary files on the server by exploiting a path traversal flaw where user-supplied paths are not properly validated before file deletion operations.

Detection Guidance

Check the installed version of the WPvivid Backup & Migration plugin. If it is below 0.9.134, the system is vulnerable. Logs may show unusual file deletion attempts by administrators.

Impact Analysis

An attacker with administrator access could delete critical files on the server, including those outside the web root. This could lead to data loss, system instability, or unauthorized access to other parts of the server.

Compliance Impact

This vulnerability could lead to unauthorized file deletion, potentially violating data integrity and confidentiality requirements under GDPR and HIPAA. Organizations may face compliance violations if sensitive data is deleted or exposed due to this flaw.

Mitigation Strategies

Update the WPvivid Backup & Migration plugin to version 0.9.134 or later immediately. Restrict administrative access to trusted users only and monitor for unauthorized file deletions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82194. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart