CVE-2026-42696

CVE-2026-42696 is a critical unauthenticated remote code execution flaw (CWE-94, code injection) in the WordPress plugin SiteVault – Backup, Restore, Migration & Cloning, affecting versions 1.5.19 and earlier. CVSS 3.1 rates it 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), meaning a remote attacker can trigger it over the network with no credentials and no user interaction. Successful exploitation can run arbitrary code with high impact on confidentiality, integrity, and availability, and the changed scope means compromise can extend beyond the plugin to the WordPress site and its host. WordPress sites running this plugin at version 1.5.19 or below are affected. It is not in CISA’s Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.

What to do: Treat SiteVault – Backup, Restore, Migration & Cloning 1.5.19 and earlier as vulnerable and upgrade to a vendor-confirmed patched release as soon as one is published; do not assume an unlisted newer version is fixed without checking the advisory. Until then, deactivate or remove the plugin on internet-facing WordPress sites. Review web logs, unexpected PHP files, and new administrator accounts for signs of compromise.