CVE-2023-5576

CRITICAL

The Migration, Backup, Staging - WPvivid plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 0.9.91 via Google Drive API secrets stored in plainte...

Affects 1 product across 1 vendor.

CVSS 3.19.3
EPSS0.9%
Percentile58th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, requires user interaction, can impact systems beyond the vulnerable component, full confidentiality impact, full integrity impact, no availability impact.
CWE Weakness Definitions
CWE-200: Exposure of Sensitive Information

Application reveals restricted data such as system internals, credentials, or user data to unauthorized actors.

Related Attack Patterns (CAPEC)
CAPEC-13 Subverting Environment Variable Values
via CWE-200
CAPEC-59 Session Credential Falsification through Prediction
via CWE-200
CAPEC-60 Reusing Session IDs (aka Session Replay)
via CWE-200
CAPEC-79 Using Slashes in Alternate Encoding
via CWE-200
CAPEC-285 ICMP Echo Request Ping
via CWE-200
Show all 59

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

The Migration, Backup, Staging - WPvivid plugin for WordPress is vulnerable to Sensitive Information Exposure due to Google Drive API secrets stored in plaintext in the plugin source, allowing unauthenticated attackers to potentially impersonate the WPVivid Google Drive account.

BSID: BS-2023-GLOBAL-178140-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2023-5576?
The Migration, Backup, Staging - WPvivid plugin for WordPress is vulnerable to Sensitive Information Exposure due to Google Drive API secrets stored in plaintext in the plugin source, allowing unauthenticated attackers to potentially impersonate the WPVivid Google Drive account.
What is the CVSS score for CVE-2023-5576?
CVE-2023-5576 has CVSS 9.3 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. EPSS: 0.9%.
Is CVE-2023-5576 actively exploited?
No confirmed active exploitation of CVE-2023-5576 as of 2026-09-25.
How do I remediate CVE-2023-5576?
Priority: IMMEDIATE.
What systems are affected by CVE-2023-5576?
CVE-2023-5576 affects Wpvivid Migration, Backup, Staging.
Vulnerability Details
CVE IDCVE-2023-5576
BSIDBS-2023-GLOBAL-178140-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Published2023-10-20
Last Modified2026-06-17
ICS Relevance0%
Weakness (CWE)
Exposure of Sensitive Information
SourceNVD
Official Description

The Migration, Backup, Staging - WPvivid plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 0.9.91 via Google Drive API secrets stored in plaintext in the publicly visible plugin source. This could allow unauthenticated attackers to impersonate the WPVivid Google Drive account via the API if they can trick a user into reauthenticating via another vulnerability or social engineering.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Attackers can exploit this vulnerability by accessing the publicly visible plugin source code, which contains Google Drive API secrets in plaintext. If an attacker can trick a user into reauthenticating, they could gain unauthorized access to the WPVivid Google Drive account.

Exploitation Likelihood: HIGH

Affected Products
VendorProductAffected Versions
Wpvivid Migration, Backup, Staging ≤ 0.9.91
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1092 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hasha4db3a5e7ec928ab13282bc08dab19eed10aa9ce4cc7c630875c7d8957c9e1d9558a6b52d6f972bf21c72946deb1ce52958b6b75a98dc0ea4f8c750a27e0f33d
Related CVEs affecting Wpvivid
CVE-2024-56273 9.8 Missing Authorization vulnerability in wpvividplugins WPvivid Backup and Migr... CVE-2026-1357 9.8 The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPr... CVE-2024-1982 9.1 The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable t... CVE-2024-1981 9.1 The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable t... CVE-2020-36842 8.8 The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable t...
View all Wpvivid CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.3 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →