CVE-2023-4274
📋 TL;DR
The WPvivid WordPress plugin up to version 0.9.89 contains a directory traversal vulnerability that allows authenticated administrators to delete arbitrary directories on the server. This affects WordPress sites using vulnerable versions of the WPvivid Migration, Backup, Staging plugin. The risk is highest in shared hosting environments where directory deletion could impact other sites.
💻 Affected Systems
- WPvivid Migration, Backup, Staging WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through deletion of critical system directories, leading to service disruption, data loss, and potential privilege escalation affecting all sites on shared hosting.
Likely Case
Malicious administrator or compromised admin account deletes website files, plugins, or configuration files causing site downtime and data loss.
If Mitigated
Limited to directory deletion within the WordPress installation if proper file permissions and isolation are configured.
🎯 Exploit Status
Exploitation requires administrative access. The vulnerability is in the file deletion functionality with insufficient path validation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.9.90 and later
Vendor Advisory: https://wordpress.org/plugins/wpvivid-backuprestore/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Migration, Backup, Staging – WPvivid' and click 'Update Now'. 4. Alternatively, download version 0.9.90+ from WordPress.org and manually update.
🔧 Temporary Workarounds
Disable WPvivid Plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate wpvivid-backuprestore
Restrict Administrative Access
allLimit WordPress administrative accounts to trusted users only
🧯 If You Can't Patch
- Remove administrative privileges from untrusted users
- Implement file system monitoring for unexpected directory deletions
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins for WPvivid version. If version is 0.9.89 or lower, you are vulnerable.Check Version:
wp plugin get wpvivid-backuprestore --field=versionVerify Fix Applied:
After updating, verify the plugin version shows 0.9.90 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- WordPress audit logs showing directory deletion events
- Web server logs with POST requests to wpvivid deletion endpoints containing '../' patterns
Network Indicators:
- HTTP POST requests to /wp-admin/admin-ajax.php with 'action=wpvivid_delete_file' containing path traversal sequences
SIEM Query:
source="wordpress.log" AND "wpvivid_delete_file" AND ("../" OR "..\")🔗 References
- https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/tags/0.9.89/includes/class-wpvivid-setting.php#L200
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2956458%40wpvivid-backuprestore%2Ftrunk&old=2948265%40wpvivid-backuprestore%2Ftrunk&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/5d94f38f-4b52-4b0d-800c-a6fca40bda3c?source=cve
- https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/tags/0.9.89/includes/class-wpvivid-setting.php#L200
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2956458%40wpvivid-backuprestore%2Ftrunk&old=2948265%40wpvivid-backuprestore%2Ftrunk&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/5d94f38f-4b52-4b0d-800c-a6fca40bda3c?source=cve
