Directory Creation Vulnerability in WPvivid Backup & Migration Plugin for WordPress
CVE-2025-12654
2.7LOW
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 21 December 2025
What is CVE-2025-12654?
The WPvivid Backup & Migration plugin for WordPress is susceptible to arbitrary directory creation. This vulnerability arises due to the insufficient restriction within the check_filesystem_permissions() function, which allows authenticated users with Administrator-level access and higher to create directories at unauthorized locations. As a result, this could potentially lead to unauthorized data exposure or further exploitation within the site.
Affected Version(s)
Migration, Backup, Staging – WPvivid Backup & Migration * <= 0.9.120