WPvivid Plugin up to 0.9.136 on WordPress Import unrestricted upload

Summaryinfo

A vulnerability has been found in WPvivid Plugin up to 0.9.136 and classified as problematic. The impacted element is an unknown function of the component Import. Performing a manipulation results in unrestricted upload. This vulnerability is known as CVE-2026-115243. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic has been found in WPvivid Plugin up to 0.9.136. This affects an unknown part of the component Import. The manipulation with an unknown input leads to a unrestricted upload vulnerability. CWE is classifying the issue as CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not validate the extension of the file it actually stores when handling an import upload: it checks the extension of a separate request field while saving the uploaded file itself with WordPress's upload type-checking disabled, so an authenticated administrator can store a file with an arbitrary extension, including a PHP file, in the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137's import directory. This is an incomplete fix of CVE-2025-5961, whose extension check was applied to the wrong value.

The advisory is shared at wpscan.com. This vulnerability is uniquely identified as CVE-2026-115243 since 10/22/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. The exploitation requires an enhanced level of successful authentication. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1608.002 for this issue.

Upgrading to version 0.9.137 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• WordPress Plugin

Name

• WPvivid Plugin

Version

• 0.9.136

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion