Description

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied path before using it in a file deletion routine, allowing administrators to delete arbitrary files on the server, including files outside the web root.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-04T07:17:10.840Z",
  "pubdate": "2026-09-04T07:17:10.840Z",
  "executiveSummary": "The WPvivid Backup, Migration & Staging WordPress plugin prior to version 0.9.134 contains a critical security flaw involving insufficient input validation within a file deletion routine.\nThis vulnerability is classified as an Arbitrary File Deletion issue, enabling authenticated administrative users to delete files from the underlying filesystem.\nThe vulnerability resides in the application logic responsible for managing backup or temporary files, which fails to sanitize or constrain user-supplied path parameters to the intended directory structures.\nSuccessful exploitation allows an attacker with administrative privileges to remove critical system files, configuration files, or other sensitive data, potentially leading to a complete compromise of the WordPress site's integrity, service availability, or the underlying host environment.\nThe scope of this vulnerability extends beyond the web root, as the lack of path traversal filtering allows deletion of any file accessible to the web server process permissions.\nGiven the requirement for administrative-level access, the primary risk involves privilege escalation from compromised administrator accounts or malicious actions taken by rogue administrators, resulting in a permanent Denial of Service (DoS) or site breakage.",
  "technicalDetails": "The vulnerability originates from a flaw in the file processing component of the WPvivid plugin, specifically within the logic designated to handle the deletion of backup archives or temporary migration data.\nThe core issue is a lack of path normalization and validation when handling user-provided file paths. When the plugin processes a request to delete a file, it fails to verify that the target path resides within the authorized directories (e.g., the plugin's designated upload or backup folder).\nAn attacker can exploit this by injecting path traversal sequences (e.g., '../') into the file path parameter supplied to the deletion routine. Because the application processes this input without verifying against an allowlist or performing canonicalization, the underlying PHP file deletion function is executed on the path resulting from the traversal.\nThe attack flow begins with the authenticated user triggering the plugin's file deletion functionality via a web request. By intercepting or crafting a request with a manipulated file path parameter, the attacker points the application to a critical system file (e.g., wp-config.php, .htaccess, or sensitive OS files).\nUpon receiving the malicious request, the plugin invokes a standard file deletion routine (such as unlink()) using the unsanitized input. If the web server process has appropriate file system permissions, the target file is removed from the server.\nThis vulnerability is present in all versions of the WPvivid plugin before 0.9.134. It requires an authenticated session with administrative privileges to execute, limiting the attack surface to those already possessing site management capabilities.\nThe impact is significant: the deletion of core WordPress files (like wp-config.php) will immediately break the site, causing a total service outage. Furthermore, deleting security-critical files can disable site protections or facilitate further exploitation. Because the vulnerability is not restricted to the web root, an attacker can manipulate files outside the public-facing directory, provided the web server user possesses the necessary read/write/delete permissions on those directories.\nNo complex exploitation vectors are required; the issue is an inherent logic error in the way the plugin handles user input before interfacing with the filesystem."
}