CVE-2026-19722: 
WordPress vulnerability analysis and mitigation

CVE-2026-19722 is an arbitrary file write vulnerability (Zip Slip) in the WPvivid — Backup, Migration & Staging WordPress plugin affecting all versions before 0.9.133. The flaw allows high-privilege users (administrators) to write files outside the intended restore directory during backup restoration, potentially leading to remote code execution. It was publicly disclosed on August 28, 2026, and assigned a CVSS score of 6.6 (Medium) (WPScan, GitHub Advisory). The vulnerability was discovered and reported by Nir Yehoshua of Cipher Security Labs (WPScan).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal), commonly known as a "Zip Slip" attack (WPScan). During backup restoration, the plugin extracts files from a backup archive without validating or sanitizing the destination paths of the extracted entries. An attacker who can supply a crafted backup package containing path-traversal sequences (e.g., ../../) in archive entry names can cause files to be written to arbitrary locations on the server's filesystem. Exploitation requires administrator-level access to the WordPress installation to initiate the restore operation (WPScan, GitHub Advisory).

Successful exploitation allows an authenticated administrator to write arbitrary files — including malicious PHP scripts — to any location accessible by the web server process, outside the intended restore directory. This can result in remote code execution on the WordPress installation, full server compromise, data exfiltration, and potential lateral movement within the hosting environment (WPScan, GitHub Advisory). While the attack requires administrator privileges, it is particularly relevant in multi-tenant or managed hosting environments where administrators may be untrusted or where credentials have been compromised.

There is currently no public proof-of-concept exploit available; WPScan has indicated the PoC will be published on September 11, 2026, to allow time for users to update (WPScan). There is no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory). Exploitation is constrained by the requirement for administrator-level access, reducing the immediate risk surface.

1. Gain Administrator Access: Obtain valid WordPress administrator credentials through phishing, credential stuffing, or another compromise vector.
2. Craft a Malicious Backup Archive: Create a ZIP archive containing a malicious PHP web shell with a path-traversal filename entry (e.g., ../../wp-content/uploads/shell.php) to target a web-accessible directory.
3. Upload the Malicious Backup: Log in to the WordPress admin panel and navigate to the WPvivid plugin's backup/restore interface. Upload the crafted backup archive as a restore package.
4. Trigger Restoration: Initiate the restore operation. The plugin extracts the archive without validating destination paths, writing the malicious PHP file to the traversed location (e.g., wp-content/uploads/shell.php).
5. Execute Arbitrary Code: Access the dropped web shell via HTTP (e.g., https://target.com/wp-content/uploads/shell.php) to execute arbitrary commands on the server (WPScan).

• File System: Unexpected PHP files (e.g., web shells) appearing in directories outside the WordPress restore path, such as wp-content/uploads/, wp-content/themes/, or the web root; files with path-traversal patterns in their origin archive.
• Logs: WordPress admin logs or server access logs showing restore operations initiated by administrator accounts, particularly at unusual times; HTTP requests to newly created PHP files in unexpected directories shortly after a restore event.
• Network: Outbound connections from the web server process to external IPs following a backup restoration event, which may indicate post-exploitation activity.
• Process: Unusual child processes spawned by the web server (e.g., Apache, Nginx, PHP-FPM) such as bash, curl, wget, or python following a restore operation (WPScan).

Update the WPvivid — Backup, Migration & Staging plugin to version 0.9.133 or later, which contains the fix for this vulnerability (WPScan, GitHub Advisory). As a temporary workaround, restrict backup restoration operations to only fully trusted administrators and monitor the file system for unexpected changes during restore operations. Implementing a Web Application Firewall (WAF) rule to detect path-traversal patterns in file upload or restore requests may provide additional defense-in-depth.

The vulnerability was discovered by Nir Yehoshua of Cipher Security Labs and responsibly disclosed through WPScan (WPScan). WPScan has withheld the full proof-of-concept until September 11, 2026, following a coordinated disclosure timeline to allow site administrators time to apply the patch. No significant broader media coverage or notable community reactions have been identified at this time.