CVE-2024-13869: WPvivid Backup & Migration RCE Vulnerability

CVE-2024-13869 Overview

CVE-2024-13869 affects the WPvivid Backup & Migration plugin for WordPress. The plugin fails to validate file types in the upload_files function across all versions up to and including 0.9.112. Authenticated attackers with Administrator-level privileges can upload arbitrary files to the affected server. Successful exploitation may lead to remote code execution on WordPress instances running NGINX. Apache-based deployments are protected by a pre-existing .htaccess file inside the target upload directory, which blocks direct access to uploaded content. The vulnerability is classified as Unrestricted Upload of File with Dangerous Type [CWE-434].

Critical Impact
Authenticated administrators can achieve remote code execution on NGINX-hosted WordPress sites by uploading executable files through the vulnerable upload_files handler.

Affected Products

WPvivid Backup & Migration plugin for WordPress
All versions up to and including 0.9.112
WordPress instances served by NGINX (Apache deployments are mitigated by bundled .htaccess)

Discovery Timeline

2025-02-22 - CVE-2024-13869 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13869

Vulnerability Analysis

The WPvivid Backup & Migration plugin exposes an upload_files function that accepts file uploads without verifying the file's MIME type or extension. Because the plugin trusts client-supplied metadata, an authenticated administrator can submit a PHP file or other executable content and place it inside the plugin's upload directory.

On NGINX servers, PHP files under the plugin path can be requested and executed by the interpreter. This turns a file upload primitive into remote code execution under the web server user. Apache installations ship with an .htaccess file inside the upload directory that denies direct HTTP access, preventing the same execution path.

Although the flaw requires administrator credentials, the impact is significant because administrators are frequently targeted through phishing, session hijacking, and credential reuse. The EPSS score of 2.228% places this issue in the 81st percentile for exploitation likelihood.

Root Cause

The root cause is missing input validation in the upload_files handler. The function does not enforce an allowlist of permitted extensions, does not verify MIME types, and does not check magic bytes before writing user-controlled content to disk under the WordPress uploads path.

Attack Vector

Exploitation requires the attacker to authenticate to WordPress with Administrator privileges. The attacker submits a crafted multipart POST request to the plugin's upload endpoint containing a PHP payload. Once the file is written to the plugin's upload folder on an NGINX-served site, the attacker requests the file directly to trigger execution.

For a technical walkthrough and proof-of-concept, see the Ryan Kozak CVE Analysis and the GitHub PoC Repository.

Detection Methods for CVE-2024-13869

Indicators of Compromise

Unexpected PHP, .phtml, or other executable files inside wp-content/uploads/wpvividbackups/ or related plugin upload directories
POST requests to WPvivid AJAX endpoints referencing upload_files from administrator sessions followed by GET requests to newly created files
Web shell traffic patterns such as short URI parameters carrying base64-encoded commands originating from the plugin's upload path
New WordPress administrator accounts created shortly before the anomalous uploads

Detection Strategies

Compare files under the WPvivid upload directory against an allowlist of expected archive extensions such as .zip, .tar, and .gz
Alert on any HTTP GET request to files under the plugin upload path that returns a Content-Type of text/html or application/x-httpd-php
Correlate authenticated admin-ajax.php calls invoking WPvivid actions with subsequent file writes on the filesystem

Monitoring Recommendations

Enable WordPress audit logging for administrator sessions and plugin file operations
Forward NGINX access logs to a central log platform and search for direct requests to plugin upload paths
Track integrity of wp-content/uploads/ with file integrity monitoring and alert on new executable file types

How to Mitigate CVE-2024-13869

Immediate Actions Required

Update the WPvivid Backup & Migration plugin to a version newer than 0.9.112 as published in the WordPress Plugin Update
Audit all WordPress administrator accounts and rotate credentials for any account that may have been compromised
Inspect the plugin's upload directory for unexpected files and remove any unauthorized content

Patch Information

The vendor released a fix in changeset 3242904 on the WordPress plugin repository. Details are available in the Wordfence Vulnerability Overview and the vendor advisory.

Workarounds

Deactivate and remove the WPvivid Backup & Migration plugin until it can be upgraded
On NGINX, add a location block that denies execution of PHP files inside wp-content/uploads/ to block the exploitation primitive
Restrict administrator access with multi-factor authentication and IP allowlisting to reduce the pool of accounts that can reach the vulnerable handler

bash

# NGINX configuration example to block PHP execution in uploads
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}