CVE-2025-5961
📋 TL;DR
The WPvivid Backup & Migration WordPress plugin allows authenticated administrators to upload arbitrary files due to missing file type validation. This vulnerability can lead to remote code execution on affected WordPress sites, particularly those running on NGINX web servers. Only WordPress instances with administrator-level compromised accounts are affected.
💻 Affected Systems
- Migration, Backup, Staging – WPvivid Backup & Migration WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise via remote code execution, allowing attackers to install malware, steal data, or pivot to other systems.
Likely Case
Unauthorized file upload leading to webshell deployment and limited code execution within WordPress context.
If Mitigated
File upload blocked or restricted to safe file types only, preventing code execution.
🎯 Exploit Status
Exploitation requires administrator credentials. Public proof-of-concept code is available in GitHub repository.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.9.117 or later
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3320877/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find WPvivid Backup & Migration plugin. 4. Click 'Update Now' if available. 5. Alternatively, download latest version from WordPress repository and replace plugin files.
🔧 Temporary Workarounds
Disable plugin temporarily
allDeactivate the vulnerable plugin until patched
wp plugin deactivate wpvivid-backuprestore
Restrict file upload directory access
linuxAdd NGINX configuration to block access to upload directory
location ~* /wp-content/uploads/wpvivid-backuprestore/ { deny all; }
🧯 If You Can't Patch
- Remove administrator access from untrusted users and implement strong password policies
- Implement web application firewall rules to block suspicious file upload patterns
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin panel under Plugins → Installed PluginsCheck Version:
wp plugin get wpvivid-backuprestore --field=versionVerify Fix Applied:
Verify plugin version is 0.9.117 or higher and check that file upload functionality validates file types📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to wpvivid-backuprestore directory
- POST requests to wpvivid_upload_import_files endpoint with executable files
Network Indicators:
- HTTP POST requests uploading files with .php, .exe, or other executable extensions to WordPress admin endpoints
SIEM Query:
source="web_server" AND (uri="*wpvivid_upload_import_files*" OR path="*/wpvivid-backuprestore/*") AND (file_extension="php" OR file_extension="exe" OR file_extension="sh")🔗 References
- https://github.com/d0n601/CVE-2025-5961
- https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/trunk/includes/class-wpvivid-export-import.php#L2210
- https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/trunk/includes/class-wpvivid-export-import.php#L2235
- https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/trunk/includes/class-wpvivid-export-import.php#L2246
- https://plugins.trac.wordpress.org/changeset/3320877/
- https://ryankozak.com/posts/cve-2025-5961/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d8ceb4a1-9354-4ed3-9a8f-45ba2057a810?source=cve
