Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-5961

The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvivid_upload_import_files' function in all versions up to, and including, 0.9.116. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: Uploaded files are only accessible on WordPress instances running on the NGINX web server as the existing .htaccess within the target file upload folder prevents access on Apache servers.

Published

2025-07-03T14:15:33.523

Last Modified

2025-07-09T17:51:24.543

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 7.2 (HIGH)

Weaknesses

Type: Primary
CWE-434

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	wpvivid	migration\,_backup\,_staging	< 0.9.117	Yes

References

https://github.com/d0n601/CVE-2025-5961 Exploit, Third Party Advisory ([email protected])
https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/trunk/includes/class-wpvivid-export-import.php#L2210 Product ([email protected])
https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/trunk/includes/class-wpvivid-export-import.php#L2235 Product ([email protected])
https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/trunk/includes/class-wpvivid-export-import.php#L2246 Product ([email protected])
https://plugins.trac.wordpress.org/changeset/3320877/ Patch ([email protected])
https://ryankozak.com/posts/cve-2025-5961/ Exploit, Third Party Advisory ([email protected])
https://www.wordfence.com/threat-intel/vulnerabilities/id/d8ceb4a1-9354-4ed3-9a8f-45ba2057a810?source=cve Third Party Advisory ([email protected])