{"affected":[{"defaultStatus":"unaffected","product":"WPvivid — Backup, Migration & Staging","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"0.9.137","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-115241","cwes":["CWE-284"],"description":"The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not verify that a submitted snapshot identifier names a snapshot it actually created before using it as a database table-name prefix, so an authenticated administrator can supply the site's table prefix, or any other string, and cause the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 to drop every matching table, including the core WordPress tables, destroying the site's database.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/d3c2dd62-6f7f-4593-9f16-c7d7949787be/"}],"kev":null,"metrics":[],"modifiedAt":1793772026503,"publishedAt":1793772026503,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/d3c2dd62-6f7f-4593-9f16-c7d7949787be/"}],"remediation":[],"revision":"6da79c716ea2d24daa1b88fd885c424a65bf2be7463a87a4d6d009a43ddba9be","sources":[{"modifiedAt":1793772026503,"name":"CNA: WPScan","retrievedAt":1793776130477,"url":"https://www.cve.org/CVERecord?id=CVE-2026-115241"}],"ssvc":null,"status":"published","title":"WPvivid Backup & Migration < 0.9.137 - Admin+ Arbitrary Database Table Deletion via Snapshot ID","updatedAt":1793776130477}