{"id":"CVE-2026-115243","kind":"vulnerability","aliases":["CVE-2026-115243"],"related":[],"title":"WPvivid backup plugin lets admins upload executable PHP files","description":"The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not validate the extension of the file it actually stores when handling an import upload: it checks the extension of a separate request field while saving the uploaded file itself with WordPress's upload type-checking disabled, so an authenticated administrator can store a file with an arbitrary extension, including a PHP file, in the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137's import directory. This is an incomplete fix of CVE-2025-5961, whose extension check was applied to the wrong value.","summary":"The WPvivid WordPress backup and migration plugin before 0.9.137 checks the extension of the wrong field during import uploads, so the saved file can have any extension. An authenticated administrator can therefore store a PHP file in the plugin's import directory and run it on the server.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wpvivid"],"not_affected_if":["plugin-not-installed","plugin-version-0.9.137-or-later"],"how_to_check":"- Check the installed WPvivid version in the WordPress plugins screen or the plugin's main file header\n- Confirm whether the plugin is active on the site","fix":"- WPvivid before `0.9.137` is affected; move to `0.9.137` or later","status":"open","published_at":"2026-11-04T06:17:01+00:00","first_seen_at":"2026-11-04T06:25:18+00:00","triaged_at":"2026-11-04T06:26:19+00:00","updated_at":"2026-11-04T06:26:19+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T06:26:19Z","model":"claude-haiku-5-5","output":{"fix":"- WPvivid before `0.9.137` is affected; move to `0.9.137` or later","reach":"internet","title":"WPvivid backup plugin lets admins upload executable PHP files","impact":"high","summary":"The WPvivid WordPress backup and migration plugin before 0.9.137 checks the extension of the wrong field during import uploads, so the saved file can have any extension. An authenticated administrator can therefore store a PHP file in the plugin's import directory and run it on the server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wpvivid","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs PHP code on the web server","analyst_note":"Confirm the affected version range and whether an upstream advisory gives a fix note beyond the NVD description.","how_to_check":"- Check the installed WPvivid version in the WordPress plugins screen or the plugin's main file header\n- Confirm whether the plugin is active on the site\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-version-0.9.137-or-later"],"who_is_affected":"Sites running the WPvivid plugin before 0.9.137 where an administrator account can use the import upload feature. The attacker must already hold administrator credentials, so sites without the plugin or with tightly controlled admin access carry less risk. unknown for further configuration detail.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000698,"input_tokens":4221,"output_tokens":552,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-115243':12A,15A '-2025':154C '-2026':11A,14A '-5961':155C '0.9.137':30B,78C,143C 'actual':88C 'admin':5A 'administr':51B,121C 'appli':160C 'arbitrari':128C 'authent':50B,120C 'backup':2A,25B,72C,137C 'check':31B,96C,116C,158C 'cve':10A,13A,153C 'directori':63B,146C 'disabl':117C 'execut':7A 'extens':33B,48B,83C,98C,129C,157C 'field':37B,103C 'file':9A,44B,57B,86C,108C,125C,133C 'fix':151C 'handl':91C 'host':19B 'import':39B,62B,93C,145C 'includ':130C 'incomplet':150C 'let':4A 'migrat':27B,73C,138C 'packag':16B 'php':8A,56B,132C 'plugin':3A,28B,60B,76C,141C 'request':102C 'run':65B 'save':43B,105C 'self':18B 'self-host':17B 'separ':101C 'server':69B 'stage':74C,139C 'store':54B,89C,123C 'therefor':53B 'type':115C 'type-check':114C 'upload':6A,40B,94C,107C,113C 'valid':81C 'valu':164C 'whose':156C 'wordpress':20B,24B,75C,111C,140C 'wpvivid':1A,21B,23B,71C,136C 'wrong':36B,163C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WPvivid plugin before 0.9.137 where an administrator account can use the import upload feature. The attacker must already hold administrator credentials, so sites without the plugin or with tightly controlled admin access carry less risk. unknown for further configuration detail.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","selfhosted","wordpress","wpvivid"],"campaign_type":null,"first_public_at":"2026-11-04T06:17:01+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115243","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115243","severity":null,"published_at":"2026-11-04T06:17:01+00:00","modified_at":"2026-11-04T06:17:01+00:00","first_seen_at":"2026-11-04T06:25:18+00:00","fetched_at":"2026-11-04T06:25:18+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}