CVE-2025-5961: WPvivid Backup & Migration plugin unrestricted file upload

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 7.2 with public exploit code and a 99th-percentile EPSS score make this a high-priority patch despite the Administrator authentication requirement and NGINX-only exposure.

What it is

The WPvivid Backup & Migration WordPress plugin fails to validate file types in the wpvivid_upload_import_files function in all versions up to and including 0.9.116. An authenticated attacker with Administrator-level access can upload arbitrary files, which may lead to remote code execution. The flaw only yields accessible uploaded files on NGINX-hosted WordPress instances, since the existing .htaccess in the upload folder blocks access on Apache.

Impact

An attacker with Administrator access gains the ability to place arbitrary files on the server, potentially achieving remote code execution. On NGINX-hosted sites the uploaded payload is directly reachable, while Apache deployments are largely shielded by .htaccess.

Attack surface

Reached over the network through the plugin's import upload functionality; the attacker must already hold Administrator-level WordPress authentication and no user interaction is required. The CVSS vector confirms network reachability with high privileges and no UI.

Exploitation

Public exploit code exists per the GitHub and ryankozak.com references tagged Exploit, and EPSS is 0.57566 (99th percentile), indicating high likelihood of exploitation activity. The CVE is not listed in CISA KEV, so no confirmed in-the-wild exploitation is documented in this record.

What to do

• Update the WPvivid Backup & Migration plugin past version 0.9.116 to the patched release referenced in the plugin changeset.
• Restrict Administrator accounts to trusted users and enforce least privilege, since exploitation requires admin-level access.
• Where feasible, run WordPress on Apache so the existing .htaccess blocks access to uploaded files, or add equivalent NGINX rules denying execution in upload directories.
• Disable or remove the plugin if it is not actively needed.
• Monitor and audit administrator account creation and login activity for signs of compromise.

Detection

• Monitor the plugin's upload/import directory for newly written executable files (PHP, phtml, etc.) and alert on unexpected file types.
• Review web server logs for POST requests to the plugin's import upload endpoint, especially from administrator sessions.
• Audit WordPress administrator account activity and changes for unauthorized additions or privilege escalation.
• Scan the uploads directory for webshell indicators and compare file hashes against known-good baselines.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.