SiteVault WordPress plugin: Remote Code Execution via code injection
Summary
The WordPress backup and migration plugin SiteVault (Royal Plugins) contains a code injection flaw (CWE-94) that allows Remote Code Inclusion. An unauthenticated attacker can run arbitrary commands on the web server over the network without user interaction, which means full compromise of the site and possibly of stored backups or migration packages. The CVSS score is 10.0 (Critical). Patchstack expects mass exploitation.
Affected
- SiteVault – Backup, Restore, Migration & Cloning up to and including 1.5.19 (CVE record: from n/a through 1.5.19; Patchstack title says <= 1.5.18)
Fixed in
- Version 1.5.20 according to the CVE record and Patchstack. No vendor advisory found.
Workaround
- No vendor workaround known.
- If no fixed version is installed, deactivate and remove the plugin (third-party guidance from Ionix).
- Restrict access to the site and the plugin endpoints with network controls or a web application firewall until a fix is verified.
Exploitation
- Not listed in CISA KEV.
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact total.
- EPSS 0.00375.
- No public proof of concept found; Patchstack expects exploitation.
Our recommendation
- Identify all WordPress sites with this plugin, including staging and migration copies, and record the version.
- Update to 1.5.20 or later. If this is not possible, deactivate and remove the plugin.
- Check affected sites for unexpected PHP files, unknown admin users and changed files; treat any finding as a security incident.
- Check backup archives and migration packages created by the plugin for exposure.
- Monitor for vendor advisories and public exploit code.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- OpenCVE CVE-2026-42696 app.opencve.io
- WordPress.org plugin page wordpress.org
- Ionix threat center www.ionix.io
- Strix CVE-2026-42696 www.strix.ai
- HOL Guard CVE-2026-42696 hol.org
- Vulners CNNVD-2026-64761123 vulners.com
- Vulners Rapid7 CVE-2026-42696 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:31.
Original description (NVD)
Improper Control of Generation of Code ('Code Injection') vulnerability in Royal Plugins SiteVault – Backup, Restore, Migration & Cloning sitevault-backup-restore-migration allows Remote Code Inclusion.This issue affects SiteVault – Backup, Restore, Migration & Cloning: from n/a through 1.5.19.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.