CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory creation in all versions up to, and including, 0.9.120. This is due to the check_filesystem_permissions() function not properly restricting the directories that can be created, or in what location. This makes it possible for authenticated attackers, with Administrator-level access and above, to create arbitrary directories.
Explanation of Vulnerability in Simple Terms
WPvivid Backup, Migration & Staging versions up to 0.9.120 contain an external input validation flaw that allows high-privilege users to modify data. The vulnerability requires administrator-level access and does not affect confidentiality or availability. Sites should update to a version newer than 0.9.120.
What an attacker can do
Modify site data if they have administrator access.
Potential impact on your site
An admin account compromised or acting maliciously could alter site data through this plugin.
Conditions required to exploit
Attacker must have administrator-level privileges on the WordPress site.
Key dates
External resources
