CVE-2025-5961: WPvivid Backup Plugin RCE Vulnerability

CVE-2025-5961 Overview

CVE-2025-5961 affects the Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress. The plugin contains an arbitrary file upload vulnerability in the wpvivid_upload_import_files function due to missing file type validation. All versions up to and including 0.9.116 are affected.

Authenticated attackers with Administrator-level access or higher can upload arbitrary files to the affected site's server. This can lead to remote code execution on the underlying host. The vulnerability is classified under [CWE-434] (Unrestricted Upload of File with Dangerous Type).

Critical Impact
Authenticated administrators can upload arbitrary PHP files and achieve remote code execution on WordPress instances running NGINX. Apache deployments are protected by an existing .htaccess file in the upload directory.

Affected Products

WPvivid Migration, Backup, Staging plugin for WordPress, all versions up to and including 0.9.116
WordPress sites running the affected plugin on NGINX web servers (exploitable path)
WordPress sites running the affected plugin on Apache (file upload occurs but execution blocked by .htaccess)

Discovery Timeline

2025-07-03 - CVE-2025-5961 published to NVD
2025-07-09 - Last updated in NVD database

Technical Details for CVE-2025-5961

Vulnerability Analysis

The WPvivid Backup & Migration plugin exposes an import handler that accepts uploaded files intended for restoring backups and migrations. The wpvivid_upload_import_files function in class-wpvivid-export-import.php processes uploaded chunks and writes them to the plugin's upload directory. The function omits server-side validation of the uploaded file's type, extension, or MIME content.

An authenticated attacker with Administrator privileges can invoke the import endpoint and supply a file with an executable extension such as .php. The file is written to disk in the plugin upload directory without sanitization. Because the upload occurs after privileged authentication, exploitation requires either compromised administrator credentials or a malicious insider.

The plugin ships a .htaccess file in the upload directory that blocks direct file execution on Apache. NGINX does not honor .htaccess directives, so uploaded PHP files remain accessible and executable when the site runs on NGINX, enabling remote code execution.

Root Cause

The root cause is missing file type validation. The import handler trusts the supplied filename and writes the payload without enforcing an allowlist of permitted extensions, validating MIME types, or stripping executable suffixes. The fix shipped in WordPress plugin changeset 3320877 introduces validation on the uploaded file before it is persisted.

Attack Vector

Exploitation requires network access to the WordPress admin interface and valid Administrator credentials. The attacker submits a crafted multipart upload request to the plugin's import endpoint, supplying a PHP webshell with a .php extension. On NGINX-backed instances, the attacker then requests the uploaded file URL to trigger PHP execution under the web server account. See the WordPress plugin code review at line 2210 and the public proof of concept for technical details.

Detection Methods for CVE-2025-5961

Indicators of Compromise

Files with executable extensions such as .php, .phtml, or .phar written to the wp-content/uploads/wpvividbackups/ directory or related plugin import paths
HTTP POST requests to admin-ajax.php invoking the wpvivid_upload_import_files action from administrator sessions
Outbound network connections from the web server process initiated shortly after suspicious uploads, suggesting webshell activity
Unexpected modifications to WordPress core or theme files following plugin import activity

Detection Strategies

Inventory installed WordPress plugins and flag any WPvivid Backup & Migration installation at version 0.9.116 or earlier
Inspect web server access logs for requests to plugin upload endpoints followed by GET requests to newly created files in the upload directory
Hash and compare files in plugin upload directories against expected backup archive formats such as .zip and .tar
Audit WordPress administrator accounts for unexpected logins or session activity preceding import operations

Monitoring Recommendations

Enable file integrity monitoring on wp-content/plugins/wpvivid-backuprestore/ and the plugin's upload destination
Forward web server, PHP-FPM, and WordPress audit logs to a centralized analytics platform for correlation
Alert on PHP process executions whose parent is the web server and whose script path resides under plugin upload directories
Track administrator account creation, role changes, and authentication events to detect credential compromise that precedes exploitation

How to Mitigate CVE-2025-5961

Immediate Actions Required

Update the WPvivid Backup & Migration plugin to the version published in changeset 3320877, which is the release after 0.9.116
Audit administrator accounts and rotate credentials for any account that cannot be fully verified
Inspect plugin upload directories for unauthorized files and remove any non-archive content
Restrict access to wp-admin by IP allowlist where operationally feasible to reduce exposure of the administrator interface

Patch Information

The vendor released a fix in WordPress plugin changeset 3320877 that adds file type validation to the import handler. Site operators should upgrade through the WordPress plugin manager or by replacing the plugin files with the patched release. Refer to the Wordfence vulnerability report for additional remediation context.

Workarounds

Deactivate and remove the WPvivid Backup & Migration plugin until the patched version can be deployed
On NGINX deployments, configure the server to deny execution of PHP files within wp-content/uploads/ directories using a location block that matches plugin upload paths
Enforce multi-factor authentication for all WordPress administrator accounts to raise the cost of credential-based exploitation
Apply web application firewall rules that block uploads with executable extensions to the wpvivid_upload_import_files action

bash

# NGINX configuration example: block PHP execution within WordPress uploads
location ~* /wp-content/uploads/.*\.(php|phtml|phar|php[0-9])$ {
    deny all;
    return 403;
}