Medium severity4.9NVD Advisory· Published Oct 16, 2024· Updated Jun 17, 2026

CVE-2020-36835

Description

The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to sensitive information disclosure of a WordPress site's database due to missing capability checks on the wp_ajax_wpvivid_add_remote AJAX action that allows low-level authenticated attackers to send back-ups to a remote location of their choice for review. This affects versions up to, and including 0.9.35.

Affected products

Wpvivid/Migration\, Backup\, Staging
cpe:2.3:a:wpvivid:migration\,_backup\,_staging:*:*:*:*:*:wordpress:*:*
Range: <0.9.36
WordPress/WPvivid pluginllm-fuzzy
Range: <=0.9.35
wpvividplugins/WPvivid — Backup, Migration & Stagingv5
Range: 0
WordPress/Migration\, Backup\, Stagingwp-canonicalize

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changesetnvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/90c3f8bc-fc41-4ba7-b9f2-8873203d5794nvdThird Party Advisory
www.webarxsecurity.com/vulnerability-in-wpvivid-backup-plugin-can-lead-to-database-leak/nvdBroken Link

News mentions

No linked articles in our index yet.

cvss	0.319
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000