CVE-2024-1982 is a medium severity (CVSS 6.5) missing authorization flaw in the WPvivid Migration, Backup, Staging plugin up to 0.9.68. Unauthenticated users can call restore functions, which can lead to SQL injection or denial of service. Upgrade to 0.9.69 or higher.
What's affected
HiSolutions, the firm that found the issues in a customer project, says they were identified in version 0.9.68 of the free WPvivid Backup and Migration plugin and probably exist in older versions too. Its fix guidance is to upgrade to 0.9.69 or higher. The plugin has more than 200,000 active installations according to that write up.
Severity needs a note. NVD scores this 6.5 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. The HiSolutions write up describes consequences that sound worse than that score: calls without login that can exfiltrate WordPress data or fill the disk. I found no CVSS number in that write up, so the two do not conflict on a score, but treat the issue as serious whatever the number says.
How to check if you're exposed
If you have WP-CLI, run wp plugin list and look for wpvivid-backuprestore in the output, or wp plugin get wpvivid-backuprestore and read the version row. Without it, open the Plugins screen in WordPress admin and read the version under the plugin name. Check every site you run, including staging copies and multisite networks.
The version to look for is 0.9.68 or older. If the site has a staging or migration copy of WordPress, check that copy too, since it carries the plugin as well.
What to do now
- Update WPvivid Backup and Migration to 0.9.69 or higher on every site.
- Check web server logs for POST requests to admin-ajax.php with WPvivid actions from addresses that are not your administrators.
- Look for unexpected staging directories and unexplained disk growth.
- Rotate database credentials and WordPress salts if you find signs of misuse.
- Keep backup plugin versions in your regular update schedule, since they have wide access by design.
Why it matters
NVD lists CWE-862 (missing authorization) and CWE-89. The get_restore_progress and restore functions lacked a capability check, so anyone could call them. HiSolutions lists several AJAX actions registered for logged out users, including restore and staging functions.
It describes two consequences. One is creating staging copies repeatedly until disk space runs out, which stops the site. The other is sending site contents to a remote system named in the parameters, which exposes data. I am describing the class only; the write up has the full detail for defenders who need it.
WordPress offers two hooks for AJAX handlers, one for logged in users and one for logged out users. Registering a sensitive action on the logged out hook, or forgetting a capability check inside it, is a repeated cause of this kind of flaw. The record's KEV flag is false, and no source I retrieved reports exploitation of this CVE in the wild. You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your projects pull in the affected component. Safeguard reachability analysis can then help you separate code paths that actually call the weak component from those that only list it.
Quick check
Why is a medium score still worth fixing fast?
Because the write up describes unauthenticated calls with data exposure and disk exhaustion. Fix it with the same update as CVE-2024-1981.
What is the one step to take?
Upgrade to 0.9.69 or higher.
Sources
Last reviewed: 19 October 2026.
