Quick answers
- Is CVE-2026-82194 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-82194 being exploited in the wild.
- How severe is CVE-2026-82194?
- Medium severity, with a CVSS score of 5.5, published 4 September 2026.
- Which products and versions are affected?
- WPvivid Backup, Migration & Staging before 0.9.134.
- Is there a fix for CVE-2026-82194?
- A patch was published on 2026-09-04: Fixed in version 0.9.134 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-82194 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-82194?
- Check whether you run WPvivid Backup or Migration & Staging at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a path traversal flaw in the file deletion routine of the WPvivid plugin. The vulnerable code appends user-supplied filenames directly to the isolate directory path (wp-content/wpvivid_uploads/Isolate) without sanitization, allowing traversal sequences (e.g., ../../) to escape the intended directory. Two AJAX handlers are affected: wpvivid_delete_selected_image (deletes individual files) and wpvivid_delete_all_image (deletes entire directories). Exploitation requires administrator privileges and a valid AJAX nonce, both of which are readily available to authenticated admins. An attacker with admin access can craft AJAX requests to delete files anywhere on the filesystem, including outside the web root. The vulnerability was patched in version 0.9.134.
Affected products
- WPvivid Backup, Migration & Staging before 0.9.134
Timeline
- 2026-09-02: disclosed
- 2026-09-04: patched: Fixed in version 0.9.134