CVE-2026-115243 in WPvivid Plugin
Summary
by MITRE • 11/04/2026
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not validate the extension of the file it actually stores when handling an import upload: it checks the extension of a separate request field while saving the uploaded file itself with WordPress's upload type-checking disabled, so an authenticated administrator can store a file with an arbitrary extension, including a PHP file, in the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137's import directory. This is an incomplete fix of CVE-2025-5961, whose extension check was applied to the wrong value.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in WPvivid Backup, Migration & Staging versions prior to 0.9.137 represents a critical failure in input validation logic during file upload operations. This flaw allows authenticated administrators with access to the plugin's import functionality to bypass intended security restrictions regarding file types. The core technical issue stems from an inconsistency between how the application validates incoming data and how it processes stored files. Specifically, the developer implemented a check that verifies the extension of a separate request field rather than the actual uploaded file itself. This architectural decision creates a significant discrepancy because WordPress's native upload type-checking mechanisms are disabled for this specific operation, leaving the system reliant solely on the flawed custom validation logic.
The operational impact of this vulnerability is severe due to its classification as an incomplete fix for CVE-2025-5961. In previous iterations, the extension check was applied to incorrect values, rendering it ineffective against malicious actors. The current iteration attempts to address this by checking a different field but fails to validate the actual file payload being stored in the import directory. Consequently, an attacker who has obtained administrative credentials can upload files with arbitrary extensions, including executable PHP scripts. Once these files are saved within the plugin's accessible directories, they become available for execution via web requests, effectively allowing remote code execution on the compromised WordPress instance.
This vulnerability aligns closely with CWE-434, which describes the unrestricted uploading of dangerous file types. By failing to verify the actual content or extension of the uploaded artifact against a strict allowlist, the application permits the storage of executable scripts that can be leveraged for further exploitation. Furthermore, this behavior maps directly to MITRE ATT&CK technique T1505.003, known as Web Shell: Cloud Storage. Attackers utilize such vulnerabilities to deploy web shells into cloud-based or server-side directories where they remain persistent and accessible through standard HTTP requests. The presence of an authenticated administrator requirement limits the attack vector to insider threats or compromised admin accounts but significantly lowers the barrier for exploitation compared to unauthenticated attacks.
Mitigation strategies must prioritize immediate patching to version 0.9.137 or later, which corrects the validation logic to inspect the actual uploaded file's extension rather than relying on auxiliary request fields. Until patches are applied, administrators should restrict access to the import functionality using additional authentication layers such as two-factor authentication and IP whitelisting. It is also advisable to disable PHP execution in directories designated for uploads through web server configuration directives like Apache's LimitRequestBody or Nginx's location blocks that deny script interpretation. Regular auditing of uploaded files and monitoring for unusual file creation events can help detect potential exploitation attempts early, ensuring the integrity of the WordPress environment remains intact against this specific class of upload-based attacks.