SiteVault WordPress Plugin Has CVSS 10 RCE Bug

The SiteVault WordPress backup plugin has a CVSS 10.0 unauthenticated remote code execution flaw. If it is installed and active on any site you operate, disable it now.

CVE-2026-42696 affects SiteVault Backup, Restore, Migration and Cloning through version 1.5.19. The Patchstack advisory, published October 10, classifies this as unauthenticated RCE: no WordPress credentials are needed to reach the vulnerable code path.

CVSS 10.0 is the ceiling NVD assigns. It indicates a network-exploitable flaw with no authentication or user interaction required, and full impact on confidentiality, integrity, and availability. Backup plugins compound the problem. They typically run with broad file system access by design, so a successful exploit here can reach further than a compromise of a typical plugin.

What to do

Check your plugin inventory. If SiteVault Backup, Restore, Migration and Cloning appears in your active plugins list, disable it until a patched release is available.

On WP-CLI: wp plugin list --status=active | grep -i sitevault

No confirmed patch exists for the current version range as of the Patchstack disclosure. Watch the plugin’s WordPress.org page for an update. If disabling is not immediately practical, restrict public access to the WordPress admin interface and any backup-related URLs as a stopgap.

Site operators managing WordPress at scale should treat this as a priority action item, not something to fold into a routine update cycle.

Related coverage from this week: three critical WooCommerce plugin CVEs and four CVSS 9.8 auth bypass flaws both published in the last eight days.