File Upload Validation Flaw in WPvivid Backup & Migration Plugin by WordPress
CVE-2026-115243
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 4 November 2026
Badges
What is CVE-2026-115243?
The WPvivid Backup, Migration & Staging plugin for WordPress prior to version 0.9.137 is susceptible to a file upload flaw. This vulnerability arises because the plugin fails to appropriately validate the file extension of uploads. When handling import uploads, instead of checking the actual file, it incorrectly verifies a separate request field. Consequently, an authenticated administrator could exploit this weakness by uploading arbitrary file types, including PHP files, into the plugin's import directory. This issue represents an incomplete fix of a previous vulnerability, highlighting the importance of proper file validation in plugin security.
Affected Version(s)
WPvivid — Backup, Migration & Staging 0.9.117 < 0.9.137
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.