Description

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131 does not sanitise a value taken from an unauthenticated request before using it to build a log file path, allowing an attacker holding a site to site transfer key to create a log file in any existing writable directory of the site, including the web root. The file name always carries a fixed suffix and the contents are always the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131's own log header, so only the location of the file is attacker controlled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-16T06:16:52.487Z",
  "pubdate": "2026-08-16T06:16:52.487Z",
  "executiveSummary": "An arbitrary file creation vulnerability exists within the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131. The vulnerability stems from insufficient sanitization of user-supplied input derived from an unauthenticated request. This parameter is directly utilized in constructing a log file path, enabling an attacker possessing a site to site transfer key to generate a log file within any existing writable directory of the target site, including the web root.\nWhile the file name incorporates a fixed suffix and the contents consist strictly of the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131 log header, the ability to control the file creation location introduces significant risk implications. Successful exploitation allows unauthorized file placement on the filesystem, which may lead to directory traversal conditions, information disclosure, or further system compromise depending on the targeted directory permissions and environment configurations.\nExploitation requires network access to the target WordPress instance, possession of a valid site to site transfer key, and targeting versions prior to 0.9.131. The risk profile spans integrity and availability concerns regarding the underlying filesystem structure.",
  "technicalDetails": "The root cause of the vulnerability resides in the improper neutralization of input data processed by the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131. Specifically, the vulnerable component processes an incoming unauthenticated request containing a parameter used dynamically in file path construction for logging mechanisms without implementing adequate validation or sanitization routines.\nThe attack flow begins when an attacker formulates a malicious request directed at the vulnerable WordPress endpoint. To successfully interact with the vulnerable functionality, the attacker must hold a valid site to site transfer key. Upon submission, the unauthenticated request supplies a manipulated value that dictates the directory path where the log file is instantiated.\nBecause the application fails to restrict path traversal sequences or enforce strict boundary checks on the input value, the underlying filesystem API concatenates the attacker-supplied directory with the logging routine. Consequently, the application attempts to write a log file to any existing writable directory specified by the attacker, including sensitive locations such as the web root.\nRegarding payload behavior and constraints, the attacker does not have arbitrary control over the file contents or the complete file name. The generated file name always carries a fixed suffix, and the payload contents are statically defined as the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131 own log header. Despite these content and naming constraints, the arbitrary location control allows file placement across the filesystem structure where web server write permissions are present.\nThe technical requirements for exploitation include network exposure to the WordPress REST API or handling scripts associated with the plugin, accessibility of the unauthenticated request vector, and knowledge or acquisition of a site to site transfer key. The post-exploitation impact is characterized by unauthorized file creation in arbitrary writable directories, potentially facilitating application logic disruption, web root pollution, or preparatory steps for secondary exploitation chains."
}