Description

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not sanitise a user supplied list of identifiers before using it in a SQL query, allowing administrators to perform SQL injection attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.1",
  "pubDate": "2026-09-02T06:17:19.890Z",
  "pubdate": "2026-09-02T06:17:19.890Z",
  "executiveSummary": "The WPvivid Backup, Migration & Staging plugin for WordPress, specifically in versions prior to 0.9.133, contains a critical SQL injection vulnerability.\nThis vulnerability exists due to the failure of the application to properly sanitize user-supplied identifiers before incorporating them into database queries.\nSuccessful exploitation of this flaw allows an authenticated administrator to manipulate SQL statements, potentially leading to unauthorized data exfiltration, modification, or destruction within the WordPress database.\nThe vulnerability requires administrative privileges, meaning an attacker must already have compromised or possess an account with administrative-level access to the WordPress environment.\nGiven the nature of the vulnerability, the risk implications are high, as SQL injection facilitates direct interaction with the site's database backend, bypassing standard application-level controls.\nAttackers can leverage this vulnerability to gain complete control over the site's data or perform further privilege escalation and persistence activities.",
  "technicalDetails": "The vulnerability is rooted in the improper handling of user-supplied input when processing identifiers within the WPvivid plugin's database abstraction layer.\nIn versions prior to 0.9.133, the plugin accepts a list of identifiers from the user context and fails to apply adequate sanitization or parameterization before embedding these values directly into SQL query strings.\nThis deficiency violates standard secure coding practices, which necessitate the use of prepared statements or robust escaping functions to ensure that user input is treated strictly as data and not as executable query logic.\nThe attack flow begins when an authenticated administrator interacts with a plugin feature that triggers the vulnerable database query. By supplying a crafted payload containing malicious SQL syntax instead of the expected identifier, the attacker forces the database to execute arbitrary commands.\nBecause the application concatenates these unvalidated identifiers directly into the query, the database interpreter cannot distinguish between the intended command structure and the attacker's injected code.\nExploitation allows for common SQL injection techniques, including boolean-based, time-based, or error-based blind SQLi, as well as UNION-based extraction, which could allow the attacker to dump sensitive tables, such as wp_users, or modify administrative settings directly in the database.\nSince the vulnerability resides within the plugin's interaction with the SQL layer, the impact is limited only by the privileges associated with the database user configured for the WordPress installation. In many common configurations, this provides full read/write access to the entire site database.\nThe lack of input sanitization implies that any parameter expected to represent an ID or a collection of identifiers is a potential entry point for exploitation. The vulnerability is triggered during the execution of administrative functions, which limits the initial access vector to authenticated users, but significantly expands the threat profile once an account is compromised."
}