Description

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrators to write files of permitted types to arbitrary locations on the server and to overwrite existing files.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-04T07:17:10.743Z",
  "pubdate": "2026-09-04T07:17:10.743Z",
  "executiveSummary": "The WPvivid Backup, Migration & Staging WordPress plugin, specifically versions prior to 0.9.134, is susceptible to an Arbitrary File Write vulnerability.\nThe flaw originates from insufficient validation of user-supplied filenames when constructing destination paths for file operations.\nAn authenticated attacker with administrative privileges can manipulate the file write process to write files of permitted types to arbitrary locations within the filesystem.\nThis vulnerability poses a significant security risk, as it enables the overwriting of critical system or application files, potentially leading to unauthorized configuration changes, service disruption, or further exploitation of the WordPress environment.\nSuccessful exploitation requires the attacker to possess administrative-level access to the WordPress dashboard, limiting the attack surface to trusted or compromised privileged accounts.",
  "technicalDetails": "The vulnerability is classified as an Improper Neutralization of Special Elements used in a Pathname (Path Traversal/Arbitrary File Write) vulnerability. It occurs due to a lack of server-side sanitization on input parameters used to define file save locations during backup or migration routines.\nRoot Cause: The plugin logic fails to adequately sanitize or validate user-controlled inputs that determine the final path of generated files. By failing to perform proper path canonicalization or strict path validation, the plugin allows the inclusion of path traversal sequences (e.g., ../) or absolute paths within the filename input field.\nAttack Flow: An authenticated administrator initiates a file operation (such as a backup or migration task). During the request, the user supplies a crafted filename or path parameter. The application backend accepts this unsanitized input and uses it to construct a filesystem path using functions that write data to the server disk. Because the path is not restricted to a designated upload directory, the attacker can influence the location where the server writes these files. If the destination directory has write permissions accessible to the web server process, the application effectively performs a write operation to a location outside of the intended scope.\nExploitation Method: An attacker exploits this by intercepting the request responsible for saving or generating files and modifying the filename parameter to point to a sensitive location (e.g., overwriting a plugin configuration file or a core WordPress file). If the file type restriction only checks for 'permitted types' (such as .zip or .sql), the attacker can still overwrite existing files with content matching that extension, potentially causing denial-of-service by corrupting existing backups or altering plugin state.\nPost-Exploitation: The primary impact is the ability to overwrite existing files on the server. If the attacker overwrites sensitive files, they may manipulate site behavior, disable security features, or corrupt data integrity. This necessitates administrative privileges, but it serves as a critical vector for maintaining persistence or escalating impact within an already compromised administrative session."
}