PatchSiren cyber security CVE debrief
CVE-2026-17555 wpvividplugins CVE debrief
The WPvivid Backup & Migration plugin for WordPress, specifically versions up to and including 0.9.131, is vulnerable to SQL Injection via the export_data parameter. This vulnerability is due to insufficient escaping on the user-supplied parameter and a lack of sufficient preparation on the existing SQL query. The vulnerability allows authenticated attackers with Administrator-level access and above to append additional SQL queries into existing queries, potentially leading to the extraction of sensitive information from the database. The issue arises from how the plugin handles the export_data parameter in the prepare_export_post() function, where values are received, passed through sanitize_text_field() and stripslashes(), JSON-decoded, and attacker-controlled JSON object keys are collected as $posts_ids without integer casting. These values are stored in export task options and later joined with commas and interpolated directly into a `WHERE ID IN (...)` clause inside a $wpdb->get_results() call in export_post_to_xml() (unquoted, numeric context), with no $wpdb->prepare() or esc_sql(). This scenario presents a significant risk as it enables attackers to manipulate SQL queries, potentially leading to data breaches or other malicious activities. It is crucial for administrators and users of the WPvivid Backup & Migration plugin to be aware of this vulnerability and take necessary precautions to prevent exploitation, such as restricting access to the plugin's export functionality, monitoring database activity for suspicious queries, and applying vendor patches or updates when available.
- Vendor
- wpvividplugins
- Product
- WPvivid — Backup, Migration & Staging
- CVSS
- MEDIUM 4.9
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-08-01
- Original CVE updated
- 2026-08-01
- Advisory published
- 2026-08-01
- Advisory updated
- 2026-08-01
Who should care
Administrators and users of the WPvivid Backup & Migration plugin for WordPress, especially those with Administrator-level access and above, should be aware of this vulnerability and take necessary precautions to prevent exploitation.
Technical summary
The WPvivid Backup & Migration plugin for WordPress is vulnerable to SQL Injection via the export_data parameter in versions up to, and including, 0.9.131. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The values are received in prepare_export_post(), passed through sanitize_text_field() and stripslashes(), JSON-decoded, and the attacker-controlled JSON object keys are collected as $posts_ids without integer casting. They are stored in the export task options and later joined with commas and interpolated directly into a `WHERE ID IN (...)` clause inside a $wpdb->get_results() call in export_post_to_xml() (unquoted, numeric context), with no $wpdb->prepare() or esc_sql().
Defensive priority
Authenticated attackers with Administrator-level access and above can append additional SQL queries into existing queries to extract sensitive information from the database.
Recommended defensive actions
- Inventory and verify the WPvivid Backup & Migration plugin version
- Restrict access to the plugin's export functionality
- Monitor database activity for suspicious queries
- Apply vendor patches or updates when available
- Implement additional security measures such as web application firewalls
Evidence notes
The vulnerability exists in the WPvivid Backup & Migration plugin for WordPress, specifically in the export_data parameter of versions up to and including 0.9.131. The issue arises from insufficient escaping of user-supplied parameters and inadequate preparation of existing SQL queries.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-01T09:17:01.397Z and has not been modified since then.