Quick answers
- Is CVE-2026-82182 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-82182 being exploited in the wild.
- How severe is CVE-2026-82182?
- Medium severity, with a CVSS score of 4.1, published 2 September 2026.
- Which products and versions are affected?
- WPvivid Backup, Migration & Staging before 0.9.133.
- Is there a fix for CVE-2026-82182?
- A patch was published on 2026-09-02: Fixed in version 0.9.133 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-82182 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-82182?
- Check whether you run WPvivid Backup or Migration & Staging at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an SQL injection (CWE-89) in the wpvivid_isolate_selected_image AJAX handler. The plugin fails to sanitize a user-supplied list of image identifiers before passing it to a DELETE SQL query. While the SELECT statement uses an integer-sanitized copy of the list, the DELETE statement uses the raw, unsanitized input, allowing attackers to inject arbitrary SQL conditions. The attack requires administrator privileges and an active admin session (CSRF protected via nonce), but no special preconditions beyond at least one row in the Upload Cleaner table. Attackers can perform time-based blind SQL injection to extract data from any WordPress table (including user credentials). The vulnerability is fixed in version 0.9.133.
Affected products
- WPvivid Backup Migration & Staging before 0.9.133
Timeline
- 2026-08-31: disclosed
- 2026-09-02: patched: Fixed in version 0.9.133
- 2026-09-02: published