Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.9
CVE-2022-2863: The Migration, Backup, Staging WordPress plugin before 0.9.76 does not sanitise and validate a parameter before using it to read the content of a file, allowing high privilege users to read any fil...
CVE-2022-2863 · published 4 years ago
Summary
The Migration, Backup, Staging WordPress plugin before 0.9.76 does not sanitise and validate a parameter before using it to read the content of a file, allowing high privilege users to read any file from the web server via a Traversal attack
What to do
- Update wpvivid migration\,_backup\,_staging to version 0.9.76 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| wpvivid | migration\,_backup\,_staging |
< 0.9.76 cpe:2.3:a:wpvivid:migration\,_backup\,_staging:*:*:*:*:*:wordpress:*:* |
Original advisory text
The Migration, Backup, Staging WordPress plugin before 0.9.76 does not sanitise and validate a parameter before using it to read the content of a file, allowing high privilege users to read any fil...
The Migration, Backup, Staging WordPress plugin before 0.9.76 does not sanitise and validate a parameter before using it to read the content of a file, allowing high privilege users to read any file from the web server via a Traversal attack
References
- http://packetstormsecurity.com/files/168616/WordPress-WPvivid-Backup-Path-Traver... Exploit Third Party Advisory VDB Entry
- http://seclists.org/fulldisclosure/2022/Oct/0 Exploit Mailing List Third Party Advisory
- https://wpscan.com/vulnerability/cb6a3304-2166-47a0-a011-4dcacaa133e5 Exploit Patch Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-22Path Traversal
Timeline
Published16 Sep 2022
Updated24 Oct 2026
First seen29 Sep 2026
Sources
CVE-2022-2863 · NVD
Track software like this
Free during beta