CVE-2025-12656
LowCVSS 3.8Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Vulnerability in the WPvivid Backup & Migration WordPress plugin (up to version 0.9.128) allows an authenticated attacker with Administrator-level access to delete arbitrary directories on the server via the delete_cancel_staging_site() function due to insufficient path validation.
Risk Assessment
An attacker can delete critical system directories or backup data, leading to data loss and site downtime.
Recommendation
Update the WPvivid Backup & Migration plugin to version 0.9.129 or later. Limit the number of administrator accounts and regularly audit permissions.
Original NVD description (English source)
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation in the delete_cancel_staging_site() function in all versions up to, and including, 0.9.128. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary folders on the server, which leads to a loss of data.