boxscore/security
CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-19725CRITICAL
Unknown WPvivid — Backup, Migration & Staging — WPvivid Backup & Migration < 0.9.131 - Unauthenticated Path Traversal via send_to_site_connect
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  N    9.1   .0037   30.6     —
AFFECTED
  Product                                Versions     Fixed
  WPvivid — Backup, Migration & Staging  unspecified  —
TIMELINE
  Aug 13  Reserved by WPScan
  Aug 15  EXPLOIT PUBLISHED — CVE-2026-19725 (Unknown WPvivid — Backup, Migration & Staging). Public exploit reference added.
  Aug 16  Published (CNA: WPScan)
CWE-22 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

Description

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131 does not sanitise a value taken from an unauthenticated request before using it to build a log file path, allowing an attacker holding a site to site transfer key to create a log file in any existing writable directory of the site, including the web root. The file name always carries a fixed suffix and the contents are always the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131's own log header, so only the location of the file is attacker controlled.

Lifecycle

Complete event history — 3 events, chronological
DateEventDetail
August 13, 2026ReservedReserved by WPScan
August 15, 2026EXPLOIT PUBLISHEDEXPLOIT PUBLISHED — CVE-2026-19725 (Unknown WPvivid — Backup, Migration & Staging). Public exploit reference added.
August 16, 2026PublishedPublished (CNA: WPScan)

Affected

Affected products and packages — 1 row
VendorProduct / PackageEcosystemVersion introducedFixed
UnknownWPvivid — Backup, Migration & Staging———

Weaknesses

CWE-22

References (1)

Related

Authoritative record: CVE-2026-19725 at cve.org

Weaknesses: CWE-22

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-19725 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.