Vulnerability record/PUBLISHED/Published Nov 4, 2026 06:00:26 UTC
CVE-2026-115241
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not verify that a submitted snapshot identifier names a snapshot it actually created before using it as a database table-name prefix, so an authenticated administrator can supply the site's table prefix, or any other string, and cause the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 to drop every matching table, including the core WordPress tables, destroying the site's database.
Base score6.5/ 10
SeverityMediumCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityMedium
Attack vectorNetworkAV
Attack complexityLowAC
Privileges requiredHighPR
User interactionNoneUI
ScopeUnchangedS
Confidentiality impactNoneC
Integrity impactHighI
Availability impactHighA
CVSS vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:HCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityWPScan
Last updatedNov 4, 2026 14:18:21 UTC
PublishedNov 4, 2026 06:00:26 UTC
ReservedOct 22, 2026 08:17:13 UTC
Credits
- Karthik Ramakrishnan
- WPScan