This vulnerability resides in WPvivid Backup & Migration plugin version 0.9.131 and earlier, where the export_data parameter is not properly sanitized or prepared before being interpolated into a SQL WHERE clause. The flaw allows an authenticated user with Administrator or higher privileges to inject additional SQL statements that can read sensitive database content or modify existing data. The attack requires only legitimate plugin usage from a privileged account and can be executed through the plugin’s export interface.

WordPress sites utilizing the WPvivid plugin for backup, migration, and staging with versions up to and including 0.9.131 are affected. Site administrators must verify the current plugin version used.

The CVSS score of 4.9 indicates a moderate severity overall, but the exploit is limited to users with Administrator-level access, raising the practical threat to environments where such accounts exist. The EPSS score is below 1%, implying low probability of imminent exploitation; the issue is not listed in CISA's KEV catalog. Nevertheless, because the attack surface is programmatic and requires legitimate administrative credentials, organizations should treat this as a moderate risk that can have significant impact if exploited.