Description
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied path before using it in a file deletion routine, allowing administrators to delete arbitrary files on the server, including files outside the web root.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | WPvivid — Backup, Migration & Staging | < 0.9.134 | 0.9.134 |
References
- https://wpscan.com/vulnerability/bb68f7ae-e380-4154-bd77-8511d8f949d3/ exploit vdb-entry technical-description