CVE-2024-13869: Migration, Backup, Staging – WPvivid <= 0.9.112 - Authenticated (Admin+) Arbitrary File Upload via wpvivid_upload_file
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'uploadfiles' function in all versions up to, and including, 0.9.112. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: Uploaded files are only accessible on WordPress instances running on the NGINX web server as the existing .htaccess within the target file upload folder prevents access on Apache servers.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13869?
CVE-2024-13869 is considered a high-severity vulnerability due to its potential for arbitrary file uploads.
How do I fix CVE-2024-13869?
To fix CVE-2024-13869, upgrade the WPvivid Backup & Migration plugin to version 0.9.113 or later.
What type of attacks can be carried out due to CVE-2024-13869?
CVE-2024-13869 allows authenticated attackers to upload arbitrary files, which may lead to a full compromise of the affected system.
Which versions are affected by CVE-2024-13869?
CVE-2024-13869 affects all versions of the WPvivid Backup & Migration plugin up to and including version 0.9.112.
Who is vulnerable to CVE-2024-13869?
Any WordPress user utilizing the WPvivid Backup & Migration plugin versions 0.9.112 or earlier is vulnerable to CVE-2024-13869.