CVE-2025-5961

CVE-2025-5961 is an arbitrary file upload vulnerability (CWE-434) in the Migration, Backup, Staging - WPvivid Backup & Migration plugin for WordPress, caused by missing file type validation in the 'wpvivid_upload_import_files' function in all versions up to and including 0.9.116. An authenticated attacker with Administrator-level access or higher can upload arbitrary files of any type to the affected server, and uploaded files are only web-accessible when the site runs on NGINX because the existing .htaccess in the upload folder blocks direct access on Apache. By uploading a web-executable file such as a PHP script, the attacker can achieve remote code execution on the site's server (CVSS 3.1: 7.2 High). Any WordPress site running WPvivid Backup & Migration at or below 0.9.116 is affected, but only NGINX-hosted sites are exploitable for remote code execution via this path. The flaw is not yet in CISA KEV; however, two public proof-of-concept exploits are available and EPSS assigns a 57.6% probability of exploitation within 30 days (99th percentile), so near-term in-the-wild use is plausible.

What to do: Update WPvivid Backup & Migration to a release newer than 0.9.116 (the latest patched version) as soon as possible; Apache-hosted sites are shielded by the upload folder's .htaccess but should still update. Because exploitation requires Administrator-level credentials, review admin account activity, remove untrusted administrator accounts, and on NGINX-hosted sites inspect the plugin's upload folder for unexpected executable files such as .php.