Executive brief
The WPvivid Backup & Migration plugin for WordPress, which is used to manage site backups and migrations, contains a security flaw that could allow an administrator to access sensitive database information. By exploiting this vulnerability, a high-privileged user could run unauthorized database queries to extract data they are not supposed to see. This could lead to the exposure of confidential site information or user data.
Technical details
A SQL injection vulnerability exists in the WPvivid Backup & Migration plugin due to insufficient input validation and lack of query preparation in the export functionality. The vulnerability occurs when the `export_data` parameter is processed in `prepare_export_post()`; JSON-decoded keys are collected into `$posts_ids` without integer casting or sanitization. These values are later interpolated directly into a `WHERE ID IN (...)` clause within `export_post_to_xml()` using `$wpdb->get_results()` without the use of `$wpdb->prepare()` or `esc_sql()`. An authenticated attacker with Administrator-level privileges can exploit this to execute arbitrary SQL commands and extract sensitive data from the WordPress database. The issue is addressed in versions following 0.9.131.
Affected products
- WPvivid Team WPvivid Backup & Migration <= 0.9.131
Timeline
- 2026-08-01: disclosed: CVE published by Wordfence/NVD
References
- https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/tags/0.9.131/includes/class-wpvivid-export-import.php
- https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/tags/0.9.131/includes/class-wpvivid-exporter.php
- https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/tags/0.9.131/includes/class-wpvivid-exporter.php
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3627791%40wpvivid-backuprestore&new=3627791%40wpvivid-backuprestore
- https://www.wordfence.com/threat-intel/vulnerabilities/id/7130f325-a0c4-479d-ac85-94542bdb5a79?source=cve