The WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory deletion when an authenticated administrator invokes the delete_cancel_staging_site() function. The flaw stems from insufficient file path validation, allowing the removal of any folder on the server. This leads to loss of data and potentially disrupts website functionality, affecting confidentiality and integrity of the site contents. The weakness corresponds to Path Manipulation (CWE-73).

All WordPress installations that use the WPvivid plugin version 0.9.128 or earlier are impacted. The vulnerability is present in every release up to and including 0.9.128, as indicated by the plugin’s release history. Site owners who have installed or are still using these versions are therefore at risk.

The CVSS score is 3.8, indicating a moderate impact when considering the attacker's required privileges and the nature of the exploit. The EPSS score is not available, but the lack of a public exploit and the absence from the CISA KEV catalog suggest that the likelihood of widespread exploitation is low to moderate. An attacker would need Administrator-level access within the WordPress dashboard. Once logged in, they could trigger the vulnerable code path that deletes directories, leading to irreversible data loss unless backups are in place. The attack is localized to sites with the affected plugin and does not involve remote exploitation from outside the server.