CVE-2025-12654: WPvivid Plugin Privilege Escalation Flaw

CVE-2025-12654 Overview

The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory creation in all versions up to, and including, 0.9.120. This vulnerability exists because the check_filesystem_permissions() function does not properly restrict which directories can be created or their locations. Authenticated attackers with Administrator-level access or above can exploit this flaw to create arbitrary directories on the affected WordPress installation.

Critical Impact

Authenticated attackers with administrative privileges can create directories in arbitrary locations on the file system, potentially enabling further attacks such as file upload exploitation, denial of service through disk space exhaustion, or manipulation of application behavior.

Affected Products

• WPvivid Backup & Migration plugin for WordPress versions up to and including 0.9.120
• WordPress installations utilizing the vulnerable plugin versions
• All WordPress sites with the WPvivid Backup & Migration plugin enabled

Discovery Timeline

• 2025-12-21 - CVE CVE-2025-12654 published to NVD
• 2025-12-23 - Last updated in NVD database

Technical Details for CVE-2025-12654

Vulnerability Analysis

This vulnerability is classified under CWE-73 (External Control of File Name or Path), indicating that the application allows user-controlled input to influence file system operations without adequate validation. The check_filesystem_permissions() function within the WPvivid staging component fails to implement proper path validation, allowing authenticated administrators to specify arbitrary directory paths for creation.

While the requirement for Administrator-level access limits the attack surface, this vulnerability can still be significant in scenarios involving compromised administrator accounts, insider threats, or multi-site WordPress installations where lower-trust administrators may exist. The ability to create arbitrary directories can serve as a precursor to more severe attacks by manipulating the file system structure.

Root Cause

The root cause lies in the check_filesystem_permissions() function located in the class-wpvivid-staging.php file. The function fails to properly validate and sanitize the directory path parameter before performing directory creation operations. Specifically, the code does not enforce restrictions on:

• The base directory where new directories can be created
• Path traversal sequences that could escape intended boundaries
• Symbolic link resolution that might redirect operations to unintended locations

This allows an authenticated administrator to craft requests that create directories outside the expected plugin or WordPress installation scope.

Attack Vector

The vulnerability is exploitable over the network by authenticated users with Administrator-level privileges. An attacker would need to:

1. Authenticate to the WordPress installation with administrative credentials
2. Access the WPvivid Backup & Migration plugin's staging functionality
3. Craft a request to the check_filesystem_permissions() function with a malicious directory path
4. The plugin would create the specified directory without adequate path validation

The vulnerability exists in the staging module of the plugin, specifically around lines 1535-1571 in the class-wpvivid-staging.php file. The attack requires no user interaction once administrative access is obtained. Technical details can be found in the WordPress Plugin Code Repository and the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-12654

Indicators of Compromise

• Unexpected directories appearing in the WordPress installation or server file system
• Unusual activity in web server access logs related to the WPvivid staging endpoints
• Directories created outside of standard WordPress content paths (wp-content/, uploads/, etc.)
• File system monitoring alerts for directory creation in sensitive locations

Detection Strategies

• Monitor WordPress administrative activity logs for unusual plugin usage patterns
• Implement file integrity monitoring (FIM) solutions to detect unexpected directory creation
• Review web application firewall (WAF) logs for suspicious requests to WPvivid plugin endpoints
• Enable and review PHP error logs for path-related warnings or errors

Monitoring Recommendations

• Configure SentinelOne to monitor file system changes and alert on unexpected directory creation
• Implement WordPress audit logging plugins to track administrator actions
• Set up alerts for modifications to the staging functionality of backup plugins
• Regularly audit administrative user accounts and their activities

How to Mitigate CVE-2025-12654

Immediate Actions Required

• Update the WPvivid Backup & Migration plugin to a patched version immediately
• Review recent administrative activity logs for signs of exploitation
• Audit the file system for any unauthorized directories that may have been created
• Restrict administrative access to trusted users only

Patch Information

A security patch has been released to address this vulnerability. The fix is available in the WordPress Plugin Changeset. Administrators should update to the latest version of the WPvivid Backup & Migration plugin through the WordPress plugin management interface or by downloading the updated version from the WordPress Plugin Directory.

Workarounds

• Temporarily disable the WPvivid Backup & Migration plugin if an immediate update is not possible
• Implement web application firewall rules to block suspicious requests to plugin endpoints
• Restrict access to the WordPress admin panel using IP whitelisting or VPN requirements
• Enable two-factor authentication for all administrator accounts to prevent unauthorized access

# Disable the plugin via WP-CLI if immediate patching is not possible
wp plugin deactivate wpvivid-backuprestore

# Verify current plugin version
wp plugin get wpvivid-backuprestore --field=version

# Update to the latest patched version
wp plugin update wpvivid-backuprestore