CVE-2025-5961
BaseFortify
Publication date: 2025-07-03
Last updated on: 2025-07-09
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wpvivid | migration\,_backup\,_staging | to 0.9.117 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the WPvivid Backup & Migration plugin for WordPress, specifically in the 'wpvivid_upload_import_files' function. It lacks proper file type validation, allowing authenticated users with Administrator-level access or higher to upload arbitrary files to the server. This can potentially lead to remote code execution on WordPress sites running on NGINX web servers, as Apache servers have .htaccess rules that prevent access to uploaded files.
How can this vulnerability impact me? :
If exploited, this vulnerability allows an attacker with Administrator-level access to upload arbitrary files, which may lead to remote code execution on the affected server. This can result in full compromise of the WordPress site, including unauthorized access, data theft, site defacement, or further attacks on the hosting environment.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update the WPvivid Backup & Migration plugin to a version later than 0.9.116 where the issue is fixed. Additionally, restrict Administrator-level access to trusted users only, and if running on an NGINX web server, consider implementing additional file upload validation or restrictions to prevent arbitrary file uploads. Monitoring and limiting file upload capabilities can also help reduce risk.