CVE-2026-42696: Critical Unauthenticated RCE in WordPress SiteVault
A critical remote code execution vulnerability, tracked as CVE-2026-42696, has been reported in the WordPress plugin SiteVault – Backup, Restore, Migration & Cloning.
The vulnerability has a reported CVSS v3.1 score of 10.0, which places it in the Critical severity category. According to the Patchstack advisory, the affected plugin versions extend through 1.5.19, and exploitation may not require authentication.
Patchstack's published listing states that an official patch is not available. WordPress administrators using the plugin should therefore review their exposure and follow updated guidance from the plugin vendor and security providers.
What Is CVE-2026-42696?
CVE-2026-42696 is classified as a remote code execution (RCE) vulnerability.
Remote code execution is a serious class of security weakness in which an attacker can cause code or commands to run on a remote system. When exploited successfully, the resulting access may allow an attacker to interfere with the affected application or compromise resources available to its execution environment.
The published advisory associates this vulnerability with CWE-94, Improper Control of Generation of Code.
The public summary does not provide enough detail to establish a complete, reproducible attack path. For that reason, it would be premature to claim that a specific endpoint, request parameter, or backup operation is the confirmed cause without further technical evidence.
Which Versions Are Affected?
According to the Patchstack vulnerability listing, the affected scope is:
Product: SiteVault – Backup, Restore, Migration & Cloning
Platform: WordPress
Affected versions: Up to and including 1.5.19
Vulnerability type: Remote code execution
CWE: CWE-94
Reported severity: CVSS 10.0 — Critical
Authentication required: None, according to the advisory
Official patch: Not listed as available at the time of writing
Because affected-version data can change as an advisory is updated, site owners should confirm the latest details before making decisions about the status of an installation.
Potential Impact on WordPress Websites
An RCE vulnerability in a WordPress plugin can have serious consequences, particularly when code executes within a privileged application environment.
Depending on the execution context and hosting configuration, a successful compromise could threaten:
Website content and application integrity.
Data stored in the WordPress database.
Website configuration and locally accessible files.
Credentials and secrets available to the application.
Backups and other recovery resources accessible to the compromised environment.
SiteVault's role in backup, restoration, migration, and cloning makes it especially important for administrators to protect both the live site and separate backup copies.
A critical CVSS score indicates serious potential impact under the published scoring model. It does not establish that a particular website has already been compromised.
Recommended Mitigation
Patchstack currently reports that no official patch is available and that it cannot assign a mitigation rule for this specific vulnerability. Administrators should avoid assuming that upgrading to another version automatically resolves the issue unless the vendor explicitly confirms the fix.
1. Identify and Disable the Affected Plugin
Check the installed SiteVault version. If the site runs an affected version, consider disabling and temporarily removing the plugin until a verified fix or vendor-approved mitigation becomes available.
Plan this action carefully if the plugin is needed for scheduled backups or migrations. Ensure that an alternative, tested backup process is in place.
2. Monitor the Vendor Advisory
Check the Patchstack advisory and the plugin's official distribution page for updated affected-version information and a confirmed security release.
Do not rely solely on a version number shown by a third-party package mirror.
3. Inspect the Website for Signs of Compromise
Review web server logs, WordPress administrator accounts, recently modified files, scheduled tasks, and unexpected plugin or theme changes.
Pay special attention to changes around the period when the vulnerable plugin was installed or updated. These checks can support an investigation, but the absence of obvious indicators does not prove that the website is clean.
4. Protect Backups and Credentials
Keep a verified backup in storage that the production website cannot modify. Restrict access to hosting control panels, databases, file transfer services, and other administrative interfaces.
If there are indications of compromise, investigate before restoring the site, rotate potentially exposed credentials, and restore only from a known-clean backup.
Conclusion
CVE-2026-42696 is a critical reported RCE vulnerability affecting the WordPress SiteVault backup and migration plugin through version 1.5.19, according to Patchstack.
With a reported CVSS score of 10.0 and no official patch listed in the advisory, administrators should identify affected installations, reduce exposure, protect backups, and monitor the vendor's published guidance.
Until additional technical details are available, security decisions should be based on verified advisory information rather than assumptions about the exact exploitation mechanism.
References
Information checked on October 13, 2026. Check the latest advisory for changes to affected versions and patch availability.
