Description
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrators to write files of permitted types to arbitrary locations on the server and to overwrite existing files.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | WPvivid — Backup, Migration & Staging | 0.9.113 – < 0.9.134 | 0.9.134 |
References
- https://wpscan.com/vulnerability/ee70edba-f70e-4055-a656-63612de8097d/ exploit vdb-entry technical-description