CVE-2022-2442highCWE-502

CVE-2022-2442: high-severity vulnerability in wpvividplugins WPvivid — Backup, Migration &…

Migration, Backup, Staging – WPvivid <= 0.9.74 - Authenticated (Admin+) PHAR Deserialization

Published · Updated

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.2epss 1.8%
exploitation probability
1.8%top 22% of all CVEs
observed exploitation
nono source reports it
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to deserialization of untrusted input via the 'path' parameter in versions up to, and including 0.9.74. This makes it possible for authenticated attackers with administrative privileges to call files using a PHAR wrapper that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
wpvividplugins · WPvivid — Backup, Migration & Staging
Related CVEs — wpvividplugins WPvivid — Backup, Migration &…

In the same product, most dangerous first.

CVE-2025-5961HIGHMigration, Backup, Staging – WPvivid Backup & Migration <= 0.9.116 - Authenticated (Administrator+) Arbitrary File UploadEPSS 55.5%CVE-2024-3054HIGHWPvivid Backup & Migration Plugin <= 0.9.99 - Authenticated (Admin+) PHAR DeserializationEPSS 41.5%CVE-2026-1357CRITICALMigration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File UploadEPSS 35.1%CVE-2024-13869HIGHMigration, Backup, Staging – WPvivid <= 0.9.112 - Authenticated (Admin+) Arbitrary File Upload via wpvivid_upload_fileEPSS 2.3%CVE-2020-36842HIGHMigration, Backup, Staging – WPvivid <= 0.9.35 - Authenticated (Subscriber+) Arbitrary File UploadEPSS 1.2%CVE-2023-5576HIGHMigration, Backup, Staging – WPvivid <= 0.9.91 - Google Drive Client Secret ExposureEPSS 0.9%
References
https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/trunk/includes/staging/class-wpvivid-staging.php?rev=2749419#L1747https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/trunk/includes/staging/class-wpvivid-staging.php?rev=2749419#L1783https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2766112%40wpvivid-backuprestore%2Ftrunk%2Fincludes%2Fstaging%2Fclass-wpvivid-staging.php&new=2766112%40wpvivid-backuprestore%2Ftrunk%2Fincludes%2Fstaging%2Fclass-wpvivid-staging.phphttps://www.wordfence.com/threat-intel/vulnerabilities/id/b7e2ca2e-c495-47f8-9c18-da5ba73d9e70?source=cvehttps://www.wordfence.com/vulnerability-advisories/#CVE-2022-2442