CVE-2026-19722
Last modified
CVE-2026-19722 is a medium-severity vulnerability rated 6.6/10 on the CVSS scale. The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files extracted from a backup package during restoration, allowing high privilege users such as administrators to write arbitrary files outside the intended restore directory, which can lead to code execution.. EPSS estimates a 0.17% chance of exploitation in the next 30 days.
Description
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files extracted from a backup package during restoration, allowing high privilege users such as administrators to write arbitrary files outside the intended restore directory, which can lead to code execution.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Unknown | WPvivid — Backup, Migration & Staging | < 0.9.133 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-19722?
How severe is CVE-2026-19722?
How do I fix CVE-2026-19722?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-19715The WP OAuth Server ( Login with WordPress ) WordPress plugi…7.5
- CVE-2026-19716Stored Cross-site Scripting (CWE-79) in the user management …5.1
- CVE-2026-19717The CatFolders Document Gallery & PDF Library WordPress plug…7.5
- CVE-2026-19718The BlogVault Backup & Staging WordPress plugin before 6.65,…8.1
- CVE-2026-19719The Social Media Share Buttons & Social Sharing Icons WordPr…6.8
- CVE-2026-1972A vulnerability was found in Edimax BR-6208AC 2_1.02. The af…7.5
- CVE-2026-19723The Social Media Share Buttons & Social Sharing Icons WordPr…7.1
- CVE-2026-19725The WPvivid — Backup, Migration & Staging WordPress plugin b…9.1
- CVE-2026-19726The Visualizer WordPress plugin before 4.0.7 does not prope…6.5
- CVE-2026-19727Improper neutralization of input during web page generation …6.1
- CVE-2026-19728The Extra Product Options Builder for WooCommerce WordPress …7.5
- CVE-2026-19729A flaw was found in the key provider component of the keyclo…4.9
Are you affected by CVE-2026-19722?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST