PatchSiren cyber security CVE debrief
CVE-2025-12656 wpvividplugins CVE debrief
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation in the delete_cancel_staging_site() function in all versions up to, and including, 0.9.128. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary folders on the server, which leads to a loss of data.
- Vendor
- wpvividplugins
- Product
- WPvivid — Backup, Migration & Staging
- CVSS
- LOW 3.8
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-06
- Original CVE updated
- 2026-07-23
- Advisory published
- 2026-06-06
- Advisory updated
- 2026-07-23
Who should care
Administrators of WordPress sites using the Migration, Backup, Staging – WPvivid Backup & Migration plugin, especially those with Administrator-level access and above.
Technical summary
The vulnerability exists in the delete_cancel_staging_site() function within the Migration, Backup, Staging – WPvivid Backup & Migration plugin. Insufficient file path validation allows authenticated attackers with Administrator-level access to delete arbitrary directories on the server.
Defensive priority
low
Recommended defensive actions
- Update the Migration, Backup, Staging – WPvivid Backup & Migration plugin to a version beyond 0.9.128.
- Restrict Administrator-level access to only trusted users.
- Regularly backup critical data to prevent loss.
Evidence notes
CVE-2025-12656 has a CVSS score of 3.8 and is considered LOW severity. The vulnerability was published on 2026-06-06T00:16:40.077Z and modified on 2026-06-08T14:57:14.757Z.
Sources and references
Verified primary and authoritative sources
-
CVE-2025-12656 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2025-12656
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2025-12656 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2025-12656
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/tags/0.9.120/includes/staging/class-wpvivid-staging.php
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/tags/0.9.120/includes/staging/class-wpvivid-staging.php
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/tags/0.9.120/includes/staging/class-wpvivid-staging.php
-
Source reference
Unverified legacy reference
URL: https://wordpress.org/plugins/wpvivid-backuprestore/
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.