# CVE-2026-82194: WPvivid Backup Migration & Staging arbitrary file deletion via path traversal

Source: https://junglewise.ai/threats/cve-2026-82194-wpvivid-backup-migration-staging-arbitrary-file-deletion-via-path  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-82194 · Severity: medium · CVSS 5.5 · Published 2026-09-04

WPvivid is a popular WordPress plugin used for creating backups, migrating websites, and managing staging environments. The plugin fails to properly validate user-supplied file paths, allowing site administrators to delete arbitrary files on the server—including critical system files outside the web directory. This could lead to complete website destruction, loss of configuration files, or exposure of sensitive data.

Technologies: [WPvivid Backup, Migration & Staging](https://junglewise.ai/threats/technologies/backup-migration-staging). Vendors: [WPvivid](https://junglewise.ai/threats/vendors/wpvivid).

## Quick answers

**Is CVE-2026-82194 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82194 being exploited in the wild.

**How severe is CVE-2026-82194?** Medium severity, with a CVSS score of 5.5, published 4 September 2026.

**Which products and versions are affected?** WPvivid Backup, Migration & Staging before 0.9.134.

**Is there a fix for CVE-2026-82194?** A patch was published on 2026-09-04: Fixed in version 0.9.134 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82194 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-82194?** Check whether you run WPvivid Backup or Migration & Staging at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a path traversal flaw in the file deletion routine of the WPvivid plugin. The vulnerable code appends user-supplied filenames directly to the isolate directory path (wp-content/wpvivid_uploads/Isolate) without sanitization, allowing traversal sequences (e.g., ../../) to escape the intended directory. Two AJAX handlers are affected: wpvivid_delete_selected_image (deletes individual files) and wpvivid_delete_all_image (deletes entire directories). Exploitation requires administrator privileges and a valid AJAX nonce, both of which are readily available to authenticated admins. An attacker with admin access can craft AJAX requests to delete files anywhere on the filesystem, including outside the web root. The vulnerability was patched in version 0.9.134.

## Affected products

- WPvivid Backup, Migration & Staging before 0.9.134

## Timeline

- 2026-09-02: disclosed
- 2026-09-04: patched: Fixed in version 0.9.134

## References

- [https://wpscan.com/vulnerability/bb68f7ae-e380-4154-bd77-8511d8f949d3/](https://wpscan.com/vulnerability/bb68f7ae-e380-4154-bd77-8511d8f949d3/)

## Related threats

- [WPvivid Backup, Migration & Staging path traversal via backup directory](https://junglewise.ai/threats/cve-2026-115426-the-wpvivid-backup-migration-staging-wordpress-plugin-before-0-9)
- [WPvivid Backup Migration & Staging path traversal in staging destination](https://junglewise.ai/threats/cve-2026-115242-the-wpvivid-backup-migration-staging-wordpress-plugin-before-0-9)
- [WPvivid Backup Migration & Staging SQL injection in Upload Cleaner](https://junglewise.ai/threats/cve-2026-82182-wpvivid-backup-migration-staging-sql-injection-in-upload-cleaner)
- [WPvivid Backup, Migration & Staging path traversal in backup restore](https://junglewise.ai/threats/cve-2026-19722-wpvivid-backup-migration-staging-path-traversal-in-backup-restore)