---
id: "CVE-2026-115243"
kind: "vulnerability"
aliases: ["CVE-2026-115243"]
title: "WPvivid backup plugin lets admins upload executable PHP files"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wpvivid"]
not_affected_if: ["plugin-not-installed", "plugin-version-0.9.137-or-later"]
published_at: "2026-11-04T06:17:01+00:00"
first_seen_at: "2026-11-04T06:25:18+00:00"
updated_at: "2026-11-04T06:26:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115243", "first_seen_at": "2026-11-04T06:25:18+00:00"}]
---

# WPvivid backup plugin lets admins upload executable PHP files

The WPvivid WordPress backup and migration plugin before 0.9.137 checks the extension of the wrong field during import uploads, so the saved file can have any extension. An authenticated administrator can therefore store a PHP file in the plugin's import directory and run it on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed WPvivid version in the WordPress plugins screen or the plugin's main file header
- Confirm whether the plugin is active on the site

## Fix

- WPvivid before `0.9.137` is affected; move to `0.9.137` or later

## Timeline

- 2026-11-04T06:25:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115243

## From the sources

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not validate the extension of the file it actually stores when handling an import upload: it checks the extension of a separate request field while saving the uploaded file itself with WordPress's upload type-checking disabled, so an authenticated administrator can store a file with an arbitrary extension, including a PHP file, in the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137's import directory. This is an incomplete fix of CVE-2025-5961, whose extension check was applied to the wrong value.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_