What is GHSA-2q5f-v38g-c39x?

GHSA-2q5f-v38g-c39x is a security advisory published by GitHub Security Advisories with Medium severity. The WPvivid — Backup, Migration \u0026 Staging WordPress plugin before 0.9.138 does not properly...

Which CVE IDs does GHSA-2q5f-v38g-c39x cover?

GHSA-2q5f-v38g-c39x covers the following CVE IDs: CVE-2026-115426. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2q5f-v38g-c39x?

GHSA-2q5f-v38g-c39x has a CVSS v3 base score of 5.5, published by GitHub Security Advisories.

GHSA-2q5f-v38g-c39xMediumCVSS 5.5

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.138 does not properly...

Vendor

GitHub Security Advisories

Published

November 4, 2026

Last Modified

November 4, 2026

🔗 CVE IDs covered (1)

CVE-2026-115426 →

📋 Description

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.138 does not properly validate a backup storage directory path before using it to create directories and write files, allowing administrators to cause those directories and files to be created outside the intended backup location via path traversal.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-115426
https://wpscan.com/vulnerability/c12a6832-81c3-4bae-93a9-3a51ff986863
https://github.com/advisories/GHSA-2q5f-v38g-c39x