Path Traversal in WPvivid Backup Migration & Staging

Executive Summary

This is a path traversal vulnerability in the WPvivid Backup & Migration WordPress plugin before version 0.9.137. It allows authenticated administrators to supply a malicious staging destination folder path containing directory traversal sequences like '../'. The plugin fails to properly sanitize this input in the staging-start handler, which can lead to writing copied site files outside the intended WordPress installation directory.

Useful 0 Not Useful 0

Detection Guidance

Check if the WPvivid Backup & Migration plugin version is below 0.9.137 by inspecting the plugin files or WordPress admin panel. Look for unusual file writes outside the WordPress directory, especially in parent directories. Review server logs for suspicious staging path requests containing traversal sequences like '../'.

Useful 0 Not Useful 0

Impact Analysis

An attacker with admin access could exploit this to write files outside the WordPress directory, potentially gaining unauthorized access to sensitive files or system components. This could lead to data theft, system compromise, or further attacks on the server.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of sensitive data, which may violate compliance requirements under GDPR or HIPAA. Organizations using the vulnerable plugin version may face regulatory penalties or data breach notifications.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the WPvivid Backup & Migration plugin to version 0.9.137 or later. If updating is not possible, disable the plugin until the update is applied. Restrict administrative access to WordPress to reduce the risk of exploitation.

Useful 0 Not Useful 0