CVE-2025-5961highCWE-434

CVE-2025-5961: high-severity vulnerability in wpvividplugins WPvivid — Backup, Migration &…

Migration, Backup, Staging – WPvivid Backup & Migration <= 0.9.116 - Authenticated (Administrator+) Arbitrary File Upload

Published · Updated

48Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 7.2epss 55%
exploitation probability
55%top 1% of all CVEs
observed exploitation
nono source reports it
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvivid_upload_import_files' function in all versions up to, and including, 0.9.116. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: Uploaded files are only accessible on WordPress instances running on the NGINX web server as the existing .htaccess within the target file upload folder prevents access on Apache servers.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
wpvividplugins · WPvivid — Backup, Migration & Staging
Related CVEs — wpvividplugins WPvivid — Backup, Migration &…

In the same product, most dangerous first.

CVE-2024-3054HIGHWPvivid Backup & Migration Plugin <= 0.9.99 - Authenticated (Admin+) PHAR DeserializationEPSS 41.5%CVE-2026-1357CRITICALMigration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File UploadEPSS 35.1%CVE-2024-13869HIGHMigration, Backup, Staging – WPvivid <= 0.9.112 - Authenticated (Admin+) Arbitrary File Upload via wpvivid_upload_fileEPSS 2.3%CVE-2022-2442HIGHMigration, Backup, Staging – WPvivid <= 0.9.74 - Authenticated (Admin+) PHAR DeserializationEPSS 1.8%CVE-2020-36842HIGHMigration, Backup, Staging – WPvivid <= 0.9.35 - Authenticated (Subscriber+) Arbitrary File UploadEPSS 1.2%CVE-2024-1982MEDIUMWPvivid Backup and Migration <= 0.9.68 - Missing AuthorizationEPSS 0.8%
References
https://github.com/d0n601/CVE-2025-5961https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/trunk/includes/class-wpvivid-export-import.php#L2210https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/trunk/includes/class-wpvivid-export-import.php#L2235https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/trunk/includes/class-wpvivid-export-import.php#L2246https://plugins.trac.wordpress.org/changeset/3320877/https://ryankozak.com/posts/cve-2025-5961/https://www.wordfence.com/threat-intel/vulnerabilities/id/d8ceb4a1-9354-4ed3-9a8f-45ba2057a810?source=cve