Executive brief
WPvivid is a popular WordPress plugin that enables administrators to back up, migrate, and stage WordPress sites. The plugin fails to properly validate file paths during file uploads, allowing administrators to write files to arbitrary locations on the server outside the intended backup directory, potentially overwriting critical system files and compromising website integrity.
Technical details
The vulnerability is a path traversal flaw (CWE-22) in the wpvivid_upload_files AJAX action. The plugin accepts a user-supplied filename parameter, applies only basic text sanitization and an extension allowlist (txt, csv, zip, jpg, and conditionally htm, html, js for users with unfiltered_html capability), but fails to strip directory traversal sequences like "../" before appending the filename to the backup directory path. An authenticated administrator can exploit this by sending a POST request with traversal sequences in the filename parameter to write files outside the backup directory or even outside the web root. The vulnerability requires administrator privileges to exploit and is triggered via an AJAX endpoint that validates only the CSRF nonce and file extension, not the path itself.
Affected products
- Automattic WPvivid — Backup, Migration & Staging before 0.9.134
Timeline
- 2026-09-02: disclosed
- 2026-09-04: patched: Fixed in version 0.9.134