CVE case study
CVE-2026-82182: Admin+ SQL Injection in WPvivid Backup via the Upload Cleaner
The WPvivid Backup & Migration WordPress plugin before 0.9.133 did not sanitize a user-supplied list of identifiers before using it in a SQL query, so an administrator could inject SQL through the upload-cleaner path. Version 0.9.133 sanitizes the identifier list.
- Weakness
- CWE-89
- Affected
- WPvivid Backup & Migration before 0.9.133
- Remediation state
- Upgrade to WPvivid Backup & Migration 0.9.133 or later
- Advisory published
- 2 Sep 2026
Why it matters
WPvivid Backup & Migration is a widely installed WordPress backup, migration, and staging plugin. In versions before 0.9.133, its upload-cleaner code placed a user-supplied list of identifiers into a SQL query without sanitizing it, so an administrator could inject SQL through that parameter.
The public record scores the issue Medium at 4.1 because it requires an administrator account, which limits who can reach it. On multi-admin or agency-managed sites, though, it still lets a lower-trust administrator read or alter database contents beyond the plugin's intended queries. Version 0.9.133 sanitizes the identifier list before it reaches the query; WPScan is holding the detailed proof of concept for a coordinated disclosure window so sites can update first.