CVE-2026-17555 Overview
CVE-2026-17555 is a SQL Injection vulnerability [CWE-89] in the WPvivid Backup & Migration plugin for WordPress. The flaw affects all versions up to and including 0.9.131. The export_data parameter is processed by prepare_export_post() without integer casting or query preparation. Authenticated attackers holding Administrator-level access or above can append arbitrary SQL to an existing query in export_post_to_xml() and extract sensitive data from the WordPress database.
Critical Impact
Authenticated administrators can inject SQL into a WHERE ID IN (...) clause executed by $wpdb->get_results(), exposing arbitrary database contents including credentials, session data, and site secrets.
Affected Products
- WPvivid Backup & Migration plugin for WordPress
- Versions up to and including 0.9.131
- WordPress sites where the plugin is installed and active
Discovery Timeline
- 2026-08-01 - CVE-2026-17555 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-17555
Vulnerability Analysis
The vulnerability lives in the export workflow of the WPvivid Backup & Migration plugin. When an administrator initiates an export, the export_data parameter is handled by prepare_export_post(). The value passes through sanitize_text_field() and stripslashes(), then is JSON-decoded. The plugin then collects the JSON object keys into a $posts_ids array without casting the values to integers.
Those attacker-controlled keys are persisted in the export task options. Later, export_post_to_xml() joins the array with commas and interpolates the result directly into a raw SQL statement. The query uses an unquoted numeric context of the form WHERE ID IN (...) inside a call to $wpdb->get_results(). Neither $wpdb->prepare() nor esc_sql() is applied, so injected SQL executes as part of the original statement.
Root Cause
The root cause is a missing type coercion combined with unsanitized SQL interpolation. sanitize_text_field() strips control characters but does not neutralize SQL metacharacters. Because the values become object keys during JSON decoding, an attacker can supply arbitrary strings that survive into the SQL statement. The unquoted numeric context makes injection straightforward: no quote-breakout is required.
Attack Vector
Exploitation requires an authenticated session with Administrator privileges. The attacker submits a crafted export_data payload containing a JSON object whose keys carry SQL fragments such as 1) UNION SELECT user_pass FROM wp_users-- -. When the export task processes those keys, the injected SQL is appended to the IN (...) clause and returned in the query results. This allows the attacker to exfiltrate any data readable by the WordPress database user, including password hashes and secret keys stored in wp_options.
See the vendor code references for the vulnerable sinks: class-wpvivid-export-import.php line 1129, class-wpvivid-exporter.php line 1398, and class-wpvivid-exporter.php line 1409.
Detection Methods for CVE-2026-17555
Indicators of Compromise
- Requests to WPvivid AJAX or REST endpoints containing an export_data parameter with non-numeric JSON object keys.
- Unexpected export task option records in wp_options where stored posts_ids values contain SQL keywords such as UNION, SELECT, SLEEP, or comment sequences (-- , #).
- Anomalous wpdb errors in PHP logs referencing the WHERE ID IN (...) clause used inside export_post_to_xml().
Detection Strategies
- Inspect WordPress access logs for administrator-authenticated POSTs to WPvivid endpoints carrying JSON payloads with alphabetic characters in export_data keys.
- Enable and review the MySQL general query log for queries originating from the plugin that contain multiple statements or UNION clauses.
- Deploy WordPress-aware web application firewall rules that flag SQL metacharacters inside JSON object keys destined for WPvivid handlers.
Monitoring Recommendations
- Monitor for privilege changes and new administrator account creation, since exploitation presupposes an administrator session.
- Alert on outbound data transfers immediately following export operations initiated by the plugin.
- Track file writes under the plugin's export directory that do not correspond to legitimate scheduled backups.
How to Mitigate CVE-2026-17555
Immediate Actions Required
- Update WPvivid Backup & Migration to the version released after 0.9.131 referenced in the WordPress plugin changeset 3627791.
- Audit all WordPress administrator accounts and rotate credentials for any account that could have been compromised.
- Rotate database credentials, wp-config.php secret keys, and API tokens that could have been exposed through database reads.
Patch Information
The vendor fix is documented in the WordPress plugin changeset. Additional analysis is available in the Wordfence Vulnerability Report. Apply the vendor update through the WordPress plugin manager or by replacing plugin files with the patched release.
Workarounds
- Deactivate the WPvivid Backup & Migration plugin until the patched version is deployed.
- Restrict administrator accounts to trusted personnel and enforce multi-factor authentication on all admin logins.
- Apply web application firewall rules that reject requests to WPvivid endpoints where JSON keys in export_data contain non-numeric characters.
# Configuration example: temporarily disable the plugin via WP-CLI
wp plugin deactivate wpvivid-backuprestore
wp plugin update wpvivid-backuprestore
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
