CVE-2025-12656Disclosure

LOWCVSS 3.8 · LOW

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation in the delete_cancel_staging_site() function in all versions up to, and including, 0.9.128. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary folders on the server, which leads to a loss of data.

Back to dashboard

1.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-73

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

Public PoC is present in monitored signal
3 mentions across 2 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 3 signals
Disclosure: 2 classified signals
Peaked 1d ago at 2 mentions (2026-06-07); latest day: 1
3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d

Signal classification2 categories

Disclosure

266.7%

PoC

133.3%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-07	2	Disclosure2
2026-06-13	1	PoC1

Full discourse3 posts

Atomic Edge@atomicedgeWAF130d
PoC
https://atomicedge.io/cve-proof/cve-2025-12656-wpvivid-backuprestore-version-0-9-128-low-vulnerability-proof-of-concept CVE-2025-12656 wpvivid-backuprestore (CVSS Score 3.8) #WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecur…
Post summary
A proof‑of‑concept for CVE‑2025‑12656 affecting the WordPress plugin wpvivid‑backuprestore has been published, indicating a low‑severity CVSS 3.8 vulnerability. No evidence of active exploitation or mitigation steps is provided.
0000051
9 followersView on X
Infoflowcloud@infoflowcloud136d
Disclosure
🚨*CVE* CVE-2025-12656 The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validatio… https://www.cve.org/CVERecord?id=CVE-2025-12656 ----- Traducción: CVE-2025-12656 La … http://infoflow.cloud`
Post summary
A brief announcement of CVE-2025-12656, a directory deletion flaw in the WPvivid Backup & Migration plugin caused by inadequate file path validation.
0000027
79 followersView on X
CVE@CVEnew136d
Disclosure
CVE-2025-12656 The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validatio… https://www.cve.org/CVERecord?id=CVE-2025-12656
Post summary
The post announces CVE-2025-12656, noting that WPvivid plugin allows arbitrary directory deletion via insufficient file path validation, but provides no PoC, exploit, patch, or evidence of active use.
00000251
57.6K followersView on X

Explore more

Back to dashboard