WPvivid Backup & Migration vulnerabilities

The WPvivid Backup & Migration plugin for WordPress up to version 0.9.131 contains a SQL Injection vulnerability via the export_data parameter. Authenticated attackers with administrator-level access and above can append additional SQL queries to existing queries, allowing extraction of sensitive database information.

Vulnerability in the WPvivid Backup & Migration WordPress plugin (up to version 0.9.128) allows an authenticated attacker with Administrator-level access to delete arbitrary directories on the server via the delete_cancel_staging_site() function due to insufficient path validation.

The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory creation in all versions up to, and including, 0.9.120. The check_filesystem_permissions() function does not properly restrict the directories that can be created or their location, allowing authenticated attackers with Administrator-level access to create arbitrary directories.