WPvivid — Backup, Migration & Staging: Arbitrary file upload
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not validate the extension of the file it actually stores when handling an import upload: it checks the extension of a separate request field while saving the uploaded file itself with WordPress's upload type-checking disabled, so an authenticated administrator can store a file with an arbitrary extension, including a PHP file, in the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137's import directory. This is an incomplete fix of CVE-2025-5961, whose extension check was applied to the wrong value. The structured affected range is 0.9.117 to < 0.9.137.
- Component
- WPvivid — Backup, Migration & Staging
- Plugin slug
wpvivid-backuprestore- Affected
- 0.9.117 to < 0.9.137
- Safe version
0.9.137- Published
- Nov 04, 2026
This CVE was published Nov 04, 2026 and is one of 19 known issues for this plugin.
Update, patch or deactivate.
Update to a supported release containing the confirmed fix: 0.9.137. Authorize uploads, allowlist file types, and prevent uploaded content from executing.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not validate the extension of the file it actually stores when handling an import upload: it checks the extension of a separate request field while saving the uploaded file itself with WordPress's upload type-checking disabled, so an authenticated administrator can store a file with an arbitrary extension, including a PHP file, in the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137's import directory. This is an incomplete fix of CVE-2025-5961, whose extension check was applied to the wrong value.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L