CVE-2024-1981 is a critical severity (CVSS 9.8) SQL injection flaw in the WPvivid Migration, Backup, Staging plugin for WordPress, version 0.9.68. Unauthenticated attackers can append queries through the table_prefix parameter. Upgrade to 0.9.69 or higher, then check your logs for signs of misuse before and after the update.
What's affected
HiSolutions, the firm that found the issues in a customer project, says they were identified in version 0.9.68 of the free WPvivid Backup and Migration plugin and probably exist in older versions too. Its fix guidance is to upgrade to 0.9.69 or higher. The plugin has more than 200,000 active installations according to that write up.
NVD scores this 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and the record's description matches the HiSolutions write up on the cause and the affected version. The sources do not disagree on severity. The record notes that the injection can be used to extract sensitive information from the database.
How to check if you're exposed
If you have WP-CLI, run wp plugin list and look for wpvivid-backuprestore in the output, or wp plugin get wpvivid-backuprestore and read the version row. Without it, open the Plugins screen in WordPress admin and read the version under the plugin name. Check every site you run, including staging copies and multisite networks.
The version to look for is 0.9.68 or older. If the site has a staging or migration copy of WordPress, check that copy too, since it carries the plugin as well.
What to do now
- Update WPvivid Backup and Migration to 0.9.69 or higher on every site.
- Check web server logs for POST requests to admin-ajax.php with WPvivid actions from addresses that are not your administrators.
- Look for unexpected staging directories and unexplained disk growth.
- Rotate database credentials and WordPress salts if you find signs of misuse.
- Keep backup plugin versions in your regular update schedule, since they have wide access by design.
Why it matters
The class is CWE-89, SQL injection. The table_prefix parameter was not escaped enough and the query was not prepared, so supplied text became part of the SQL statement. HiSolutions says that SQL queries can be manipulated so that database contents can probably be read or changed without authentication.
Two things push the score to critical. No login is needed, and a WordPress database holds user records, password hashes, site settings and often customer data. Backup plugins also tend to run with elevated rights, so a flaw in one has wide reach. This CVE shares a plugin and a version with CVE-2024-1982, covered separately, and the two should be fixed together by the same update. The record's KEV flag is false, and no source I retrieved reports exploitation of this CVE in the wild. You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your projects pull in the affected component. Safeguard reachability analysis can then help you separate code paths that actually call the weak component from those that only list it.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need an account to exploit it?
The record says no. Unauthenticated attackers can reach the vulnerable parameter.
Which version fixes it?
HiSolutions recommends 0.9.69 or higher.
Sources
Last reviewed: 19 October 2026.
