CVE-2026-82182 PUBLISHED

WPvivid Backup & Migration < 0.9.133 - Admin+ SQLi via Upload Cleaner Isolation

Assigner: WPScan
Reserved: 28.08.2026 Published: 02.09.2026 Updated: 02.09.2026

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not sanitise a user supplied list of identifiers before using it in a SQL query, allowing administrators to perform SQL injection attacks.

Product Status

Vendor Unknown
Product WPvivid — Backup, Migration & Staging
Versions Default: unaffected
  • affected from 0 to 0.9.133 (excl.)

Credits

  • cyberkareem finder
  • WPScan coordinator

References

Problem Types

  • CWE-89 SQL Injection CWE