SiteVault – Backup, Restore, Migration & Cloning

SiteVault – Backup, Restore, Migration & Cloning has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2026; all 2 are fixed as of October 2026. Their average CVSS score is 7.6, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 0 high. 2026 was the busiest year with 2 disclosures.

The most common weakness is Code Injection, behind 1 of the records (50%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor.

Every one of the 2 issues recorded for SiteVault – Backup, Restore, Migration & Cloning has a vendor fix available, so running the current release closes all known holes.

All of these findings were reported by Ananda Dhakal. SiteVault – Backup, Restore, Migration & Cloning is installed on roughly 20 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSHigh
7.6/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all SiteVault – Backup, Restore, Migration & Cloning vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2026-42696

SiteVault – Backup, Restore, Migration & Cloning <= 1.5.19 - Unauthenticated Remote Code Execution

Read the full analysis

Vulnerability Records

2 records
SiteVault – Backup, Restore, Migration & Cloning banner
Latestv1.5.20

SiteVault – Backup, Restore, Migration & Cloning

Royal Plugins

Author

Royal Plugins

0.0(0)
0/100
Last Updated
2026-10-12 (8d ago)
Active Installs
20+
Downloads
2,151
Requires WP
5.8+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2026-03-14 (7mo ago)

SiteVault is a free WordPress backup, restore, and migration plugin built for reliability. Back up your entire site — database, plugins, themes, and uploads — with one click. Restore from any backup instantly, or create a migration package to move your site to a new host with automatic URL remapping and serialized data handling. SiteVault stores backups in a protected local directory on your server, works on shared hosting, and handles large sites with async processing built for strict timeout and memory limits. Works With Your Hosting & Stack SiteVault runs on any standards-compliant WordPress host and backs up any content stored in your database and uploads directory: Shared hosting — Async chunked processing keeps backups completing reliably under strict PHP timeout and memory limits. Managed hosting — Backups copy only WordPress content (database, plugins, themes, uploads), so host system folders are never included. eCommerce and memberships — Customer orders, products, course progress, and membership data are backed up as standard WordPress posts and meta. Page builders — Builder content stored in post meta and serialized fields is captured intact regardless of which builder created it. Multilingual — Translated posts and language taxonomies back up with all language relationships preserved. Caching plugins — Cache folders in wp-content sit outside the folders SiteVault copies, so backup sizes stay lean. Backup Features Full Site Backup – Complete backup of database, plugins, themes, and uploads Database-Only Backup – Quick database snapshots for content changes Plugins & Themes Backup – Back up just your plugins and themes before updates Uploads-Only Backup – Back up just your media library files Backup Preview – Modal shows components and estimated compressed size before a backup starts Backup Labels – Optional label up to 60 characters, editable on the Create Backup form and filterable on the Backups list Backup History – View all your backups with size, date, and status Backup Manifest – Each backup includes metadata about your site configuration Restore Features One-Click Restore – Restore your entire site from any backup Restore Confirmation Screen – Review tables and files that will be replaced, then type “RESTORE” to proceed — prevents accidental overwrites Backup Validation – Validates backup integrity before restoring Safe Restore – Checks permissions and requirements before starting Status Tracking – Monitor restore progress in real-time Migration Features Migration Packages – Create complete site packages for moving hosts Standalone Installer – Migration packages include a standalone installer URL Remapping – Automatic URL replacement for new domains Serialized Data Handling – Properly handles WordPress serialized data Download Packages – Download migration packages for manual upload Scheduled Backup Features Daily, Weekly, or Monthly Cadence – Set a recurring schedule and SiteVault runs backups automatically Per-Schedule Backup Type – Choose full, database-only, plugins-themes, or uploads-only per schedule Per-Schedule Retention – Set how many backups each schedule keeps; older ones prune automatically Multiple Concurrent Schedules – Run different cadences for different backup types simultaneously Manual Run – Trigger any schedule immediately from the Schedules page Developer & Automation Features WP-CLI Commands – Drive backups from the command line: wp sitevault backup, wp sitevault list, wp sitevault restore <id>, wp sitevault delete <id>, wp sitevault verify <id> Selective Restore – Restore only specific components with --components=database,plugins,themes,uploads Labeled Backups – --label=<label> flag on wp sitevault backup for scripted labeled backups Scriptable Output – --porcelain for machine-readable backup IDs and --format=table|csv|json|ids|count on list output for pipelines Unattended Runs – --yes flag skips destructive-operation prompts, so backups and restores work under cron and CI Works With System Cron – On hosts that disable WP-Cron, run wp cron event run --due-now from system cron and scheduled backups still run Core Features Protected Storage – Backups stored in protected directories Logging System – Comprehensive logs for troubleshooting Clean Interface – Simple, intuitive admin panel Lightweight – Minimal impact on site performance Secure – Proper nonce verification and capability checks Pro Features Upgrade to SiteVault Pro for advanced features: Cloud Storage – Dropbox, Google Drive, Google Cloud, Amazon S3, S3-Compatible, OneDrive, FTP/SFTP Staging Environments – Create staging sites to test changes safely Push to Live – Push staging changes to production AES-256 Encryption – Encrypt backups for maximum security Email Notifications – Get notified of backup success or failure WooCommerce Compatible – WooCommerce tables are included in every database backup, and caches and order tables are refreshed after a restore Priority Support – Fast, dedicated support from our team

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C