CVE-2025-12656: WPvivid Path Traversal Vulnerability

CVE-2025-12656 Overview

CVE-2025-12656 affects the Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress. The plugin contains insufficient file path validation in the delete_cancel_staging_site() function across all versions up to and including 0.9.128. Authenticated attackers holding Administrator-level access or above can exploit this flaw to delete arbitrary folders on the server, causing data loss. The vulnerability is classified under CWE-73: External Control of File Name or Path. Because exploitation requires Administrator privileges, real-world risk is constrained to scenarios involving compromised admin accounts or multi-administrator environments where lateral abuse is possible.

Critical Impact
Authenticated administrators can delete arbitrary directories on the underlying server, resulting in data loss and possible disruption of the WordPress site or co-located applications.

Affected Products

WPvivid Backup & Migration plugin for WordPress — all versions through 0.9.128
WordPress installations using the WPvivid staging feature
Servers hosting WordPress where the plugin process has write/delete access to directories outside the WordPress root

Discovery Timeline

2026-06-06 - CVE-2025-12656 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2025-12656

Vulnerability Analysis

The flaw resides in the delete_cancel_staging_site() function defined in includes/staging/class-wpvivid-staging.php. The function accepts a file path used to remove a staging site directory but fails to constrain that path to an expected base directory. An authenticated administrator can submit a crafted path that resolves outside the intended staging area, causing the plugin to recursively delete the target directory.

The vulnerable references include line 1268, line 1282, and line 1296 of class-wpvivid-staging.php in the 0.9.120 tag. Each location performs deletion against user-influenced path input without canonicalizing the path and verifying that it remains under the staging root. This places the issue squarely within [CWE-73], where external input governs a file system operation without adequate validation.

Root Cause

The root cause is missing path normalization and base-directory containment. The function trusts caller-supplied path components rather than computing a canonical absolute path and confirming, with a string-prefix check, that the resolved path lives inside the plugin's allowed staging directory. Without that containment check, traversal sequences and absolute paths are accepted and processed.

Attack Vector

Exploitation requires an authenticated session with Administrator privileges. The attacker invokes the staging cancellation workflow with a path value pointing to a directory of their choosing. The plugin then performs a recursive directory removal against that path under the privileges of the PHP worker, which typically include write access to the WordPress installation and adjacent web-served paths.

No verified public exploitation code is available. The mechanism is described in the Wordfence Vulnerability Report and the WordPress Code Reference Line 1268.

Detection Methods for CVE-2025-12656

Indicators of Compromise

Unexpected deletion of directories outside the WordPress installation, particularly directories owned by the web server user.
WPvivid staging log entries referencing delete_cancel_staging_site with paths outside the plugin's staging root.
Administrator accounts triggering staging cancellation actions at unusual times or from unexpected IP addresses.
File-system audit events showing recursive removals issued by the PHP-FPM or web server process targeting non-staging paths.

Detection Strategies

Inventory WordPress installations and flag any site running WPvivid Backup & Migration at version 0.9.128 or earlier.
Monitor the WordPress wp_options and plugin log tables for staging-cancel events and correlate them with file-system deletion telemetry.
Enable file integrity monitoring on directories adjacent to the WordPress webroot to surface unauthorized recursive deletions.

Monitoring Recommendations

Forward WordPress, PHP, and web server logs to a centralized analytics platform for correlation with file-system events.
Alert on administrator logins from new geographies or user agents, since exploitation hinges on a privileged session.
Track plugin version drift across managed WordPress estates to catch sites that miss the fixed release.

How to Mitigate CVE-2025-12656

Immediate Actions Required

Update the WPvivid Backup & Migration plugin to the version that follows 0.9.128 as published on the WordPress Plugin Page.
Audit existing WordPress administrator accounts and remove any that are unused, shared, or unnecessary.
Rotate credentials for all administrator accounts and enforce multi-factor authentication on the WordPress admin interface.
Back up the WordPress installation and adjacent server directories before applying changes so that recovery is possible if exploitation has already occurred.

Patch Information

The maintainers addressed the issue in the changeset referenced by the WordPress Changeset Overview. Administrators should install the latest plugin release from the official WordPress.org repository and verify the version after upgrade.

Workarounds

Deactivate and remove the WPvivid Backup & Migration plugin until the patched version is installed.
Restrict administrator role assignment to a minimum set of trusted accounts and apply least privilege to staging operations.
Run the PHP worker under a user whose write scope is limited to the WordPress installation directory, preventing deletion of unrelated server paths.
Place the WordPress admin interface behind an IP allow list or a web application firewall rule that blocks unauthenticated and untrusted access.

bash

# Configuration example: confirm the installed plugin version using WP-CLI
wp plugin get wpvivid-backuprestore --field=version

# Update the plugin to the latest available version
wp plugin update wpvivid-backuprestore

# If a patched build is not yet deployed, deactivate the plugin
wp plugin deactivate wpvivid-backuprestore