Executive brief
WPvivid is a WordPress plugin used for backing up, migrating, and staging WordPress websites. The plugin contains an SQL injection vulnerability in its Upload Cleaner feature that allows site administrators to execute arbitrary SQL commands against the website's database. An attacker with admin access could use this to extract sensitive data, modify database contents, or compromise the integrity of the website.
Technical details
The vulnerability is an SQL injection (CWE-89) in the wpvivid_isolate_selected_image AJAX handler. The plugin fails to sanitize a user-supplied list of image identifiers before passing it to a DELETE SQL query. While the SELECT statement uses an integer-sanitized copy of the list, the DELETE statement uses the raw, unsanitized input, allowing attackers to inject arbitrary SQL conditions. The attack requires administrator privileges and an active admin session (CSRF protected via nonce), but no special preconditions beyond at least one row in the Upload Cleaner table. Attackers can perform time-based blind SQL injection to extract data from any WordPress table (including user credentials). The vulnerability is fixed in version 0.9.133.
Affected products
- WPvivid Backup Migration & Staging before 0.9.133
Timeline
- 2026-08-31: disclosed
- 2026-09-02: patched: Fixed in version 0.9.133
- 2026-09-02: published