PatchTheCVECVE-2024-1981: The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to SQL Injection via the 'table_pr
CVE-2024-1981 is a critical-severity flaw (CVSS 9.8) affecting migration\, backup\, staging. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to SQL Injection via the 'table_prefix' parameter in version 0.9.68 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database
Why this priority
- Critical severity
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 1.1% (top 35%) |
| CISA exploited list | No |
| Weakness | CWE-89 |
| Published | 2024-02-29 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-1981?
migration\, backup\, staging: upgrade to newer than 0.9.68. Exact commands for each OS are on this page.
Is CVE-2024-1981 being exploited?
CVE-2024-1981 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-1981 affect?
CVE-2024-1981 affects migration\, backup\, staging. Severity is critical (CVSS 9.8). The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to SQL Injection via the 'table_prefix' parameter in version 0.9.68 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o
How urgent is CVE-2024-1981?
Priority 61/100. Critical severity; Public exploit reference; Remotely exploitable, no login, no user action
Software pages
Related CVEs
- CVE-2025-5961 HIGH 7.2 UPGRADE The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary fi
- CVE-2024-56273 MEDIUM 4.3 UPGRADE Missing Authorization vulnerability in wpvividplugins WPvivid Backup and Migration wpvivid-backuprestore allow
- CVE-2024-3054 HIGH 7.2 UPGRADE WPvivid Backup & Migration Plugin for WordPress is vulnerable to PHAR Deserialization in all versions up to, a
- CVE-2024-1982 MEDIUM 6.5 UPGRADE The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to unauthorized access due to a mi
- CVE-2024-10962 HIGH 8.8 UPGRADE The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to PHP Object Injection in all ver