CVE-2026-115243 · Package
NO FIX YET · SEE WHAT TO DO
The WPvivid WordPress backup and migration plugin before 0.9.137 checks the extension of the wrong field during import uploads, so the saved file can have any extension. An authenticated administrator can therefore store a PHP file in the plugin's import directory and run it on the server.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Sites running the WPvivid plugin before 0.9.137 where an administrator account can use the import upload feature. The attacker must already hold administrator credentials, so sites without the plugin or with tightly controlled admin access carry less risk. unknown for further configuration detail.
Not affected if plugin-not-installed, plugin-version-0.9.137-or-later
Who cares self-hosted, wordpress, wpvivid
0.9.137 is affected; move to 0.9.137 or laterThe WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not validate the extension of the file it actually stores when handling an import upload: it checks the extension of a separate request field while saving the uploaded file itself with WordPress's upload type-checking disabled, so an authenticated administrator can store a file with an arbitrary extension, including a PHP file, in the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137's import directory. This is an incomplete fix of CVE-2025-5961, whose extension check was applied to the wrong value.
This page as .md · .json · in your agent: get_signal("CVE-2026-115243")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.