Unauthenticated RCE Vulnerability Found in SiteVault WordPress Plugin Versions Up to 1.5.19
The National Vulnerability Database lists a critical flaw in Royal Plugins SiteVault that allows attackers to execute code without authentication.
Key points
- CVE-2026-42696 is rated CVSS 10 CRITICAL by the National Vulnerability Database.
- The flaw allows unauthenticated remote code execution in SiteVault versions up to 1.5.19.
- The vulnerability stems from CWE-94, indicating improper control of generated code for an interpreter.
The National Vulnerability Database has published a record for CVE-2026-42696, identifying a critical security flaw in the SiteVault plugin. This vulnerability allows for unauthenticated remote code execution in versions of the software up to and including 1.5.19.
At a glance
- CVE
- CVE-2026-42696
- Product
- Royal Plugins SiteVault – Backup, Restore, Migration & C
- CVSS
- 10 Critical
- Weakness
- code injection
- Exploited
- No known exploitation
Royal Plugins is the vendor responsible for the SiteVault – Backup, Restore, Migration & Cloning plugin. The National Vulnerability Database assigns the flaw a CVSS score of 10, categorizing it as CRITICAL severity. This score indicates that the vulnerability is exploitable without any user interaction or authentication credentials.
Technical Details and Context
The weakness is classified under CWE-94 by the National Vulnerability Database. This Common Weakness Enumeration entry describes improper control of generated code for an interpreter. The description provided in the database record explicitly states that the issue results in unauthenticated remote code execution.
Remote code execution allows an attacker to run arbitrary commands on a vulnerable server. Because the flaw is unauthenticated, attackers do not need valid login credentials to exploit it. The National Vulnerability Database record highlights the severity of this exposure for web administrators.
Affected Software and Versions
The vulnerability affects the SiteVault – Backup, Restore, Migration & Cloning plugin developed by Royal Plugins. According to the National Vulnerability Database record, all versions up to 1.5.19 are impacted by this flaw. Users running these specific versions should assume their installations are vulnerable until further notice.
The plugin is designed to assist with backup, restore, migration, and cloning tasks. The National Vulnerability Database does not list any fixed versions in the provided record. Administrators using versions lower than 1.5.19 are exposed to the risk described in the CVE entry.
What should you do?
Security professionals should verify the version of SiteVault installed on their WordPress sites immediately. If the version is 1.5.19 or older, it is considered vulnerable according to the National Vulnerability Database. Organizations should monitor for official statements from Royal Plugins regarding a patch.
What to do and how to stay safe: CVE-2026-42696
- Audit your WordPress plugins to identify if SiteVault is installed and check its current version against the vulnerable range up to 1.5.19.
- Review server logs for suspicious activity that might indicate exploitation of the unauthenticated remote code execution flaw.
- Once the vendor provides an update, apply the patch immediately to remediate the CVSS 10 CRITICAL vulnerability.
- Consider restricting access to the plugin’s endpoints using web application firewalls until a fix is available.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE ID for the SiteVault vulnerability?
The CVE ID is CVE-2026-42696, as listed in the National Vulnerability Database record.
Which versions of SiteVault are affected?
Versions up to and including 1.5.19 are affected, according to the National Vulnerability Database.
Is authentication required to exploit this flaw?
No, the National Vulnerability Database describes it as unauthenticated remote code execution.
