{"id":"CVE-2026-42696","published":"2026-10-10T20:16:35.313","lastModified":"2026-10-13T13:28:15.717","description":"Improper Control of Generation of Code ('Code Injection') vulnerability in Royal Plugins SiteVault – Backup, Restore, Migration & Cloning sitevault-backup-restore-migration allows Remote Code Inclusion.This issue affects SiteVault – Backup, Restore, Migration & Cloning: from n/a through 1.5.19.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/sitevault-backup-restore-migration/vulnerability/wordpress-sitevault-backup-restore-migration-cloning-plugin-1-5-18-remote-code-execution-rce-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A remote code execution vulnerability in SiteVault allows attackers to execute arbitrary code on the target system without authentication. This critical flaw affects versions up to 1.5.19 and could lead to full system compromise.","exploitability":"The exploit is highly practical with no authentication required, making it extremely easy to trigger from any network location with access to the vulnerable endpoint.","blast_radius":"The vulnerability could impact any website using SiteVault's backup, restore, migration, or cloning features, potentially leading to complete system takeover and data exfiltration across multiple affected installations.","remediation":"Upgrade to version 1.5.20 or later to remediate this critical RCE vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","unauthenticated","backup"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:42:28.205Z"}}