Arbitrary File Upload in WPvivid Backup Plugin

Executive Summary

This vulnerability affects the WPvivid Backup & Migration WordPress plugin versions 0.9.117 to 0.9.136. It allows authenticated administrators to upload arbitrary files, including PHP files, by bypassing extension validation. The plugin checks the file extension in one request field but saves the file without WordPress's upload type-checking, enabling malicious file uploads to the import directory.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized PHP or executable files in the WPvivid import directory. Review server logs for suspicious upload attempts by authenticated administrators. Use commands like 'find /path/to/wpvivid/import -type f -name "*.php"' to locate unexpected files.

Useful 0 Not Useful 0

Impact Analysis

An attacker with administrator access could upload a PHP file to the plugin's import directory. This could lead to remote code execution, allowing the attacker to take full control of the WordPress site, steal data, or perform other malicious actions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and security. Organizations may face legal penalties, reputational damage, and loss of customer trust if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Update the WPvivid plugin to version 0.9.137 or later immediately. Disable file uploads via the plugin if not required. Restrict write permissions to the import directory and monitor for unauthorized file uploads.

Useful 0 Not Useful 0