CVE-2023-4637: Wpvivid Migration, Backup, Staging

Medium severity, CVSS 5.3. EPSS: 0.6% chance of exploitation in the next 30 days.

The WPvivid plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the restore() and get_restore_progress() function in versions up to, and including, 0.9.94. This makes it possible for unauthenticated attackers to invoke these functions and obtain full file paths if they have access to a back-up ID.

Affected products

• Wpvivid Migration, Backup, Staging: up to and including 0.9.94

Published 2024-02-05. Last modified 2026-06-17.