What the vulnerability does
01Description
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvivid_upload_import_files' function in all versions up to, and including, 0.9.116. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: Uploaded files are only accessible on WordPress instances running on the NGINX web server as the existing .htaccess within the target file upload folder prevents access on Apache servers.
Explanation of Vulnerability in Simple Terms
02Summary
WPvivid Backup, Migration & Staging plugin versions 0.9.116 and earlier contain an unrestricted file upload vulnerability. An authenticated administrator can upload arbitrary files to the site, potentially including malicious PHP code. This allows an attacker with admin access to run their own code on the site and compromise the entire WordPress installation.
What an attacker can do
03Attacker Capabilities
Upload arbitrary files, including PHP code, to execute on the site.
Potential impact on your site
04Site Impact
A compromised admin account can be used to upload malicious files and take full control of your site.
Conditions required to exploit
05Prerequisites
Attacker must have administrator-level access to WordPress.
Key dates
06Disclosure timeline
July 3, 2025
CVE published
April 8, 2026
Record updated
