Unauthenticated RCE in SiteVault WordPress Backup Plugin
CVE-2026-42696 is an unauthenticated remote code execution flaw in the SiteVault WordPress backup plugin, rated CVSS 10.0, affecting all versions through 1.5.19.
- Vendor
- SiteVault
- Product
- SiteVault Backup, Restore, Migration & Cloning (WordPress Plugin)
- CVSS
- 10.0
- EPSS (exploit probability)
- 0.6%
- Status
- unpatched
- Published
CVE-2026-42696 is an unauthenticated remote code execution vulnerability in the SiteVault Backup, Restore, Migration and Cloning plugin for WordPress. It was disclosed by Patchstack on October 10, 2026, and affects all plugin versions through 1.5.19.
The flaw requires no WordPress credentials. An unauthenticated attacker can reach the vulnerable code path over the network and achieve remote code execution on the host server.
NVD rates the vulnerability CVSS 10.0, the highest possible score, reflecting a network-exploitable attack vector with no authentication or user interaction required and full impact on system confidentiality, integrity, and availability.
No patched release has been confirmed in the current version range as of initial disclosure. Site operators should disable the plugin immediately until the vendor releases a fix. See CVE-2026-42696 full coverage for remediation guidance.
