The WPvivid Backup & Migration plugin up to version 0.9.120 contains code that improperly validates the location and permissions for directory creation. This flaw allows an authenticated user with Administrator or higher privileges to create directories in arbitrary locations on the WordPress file system. The creation of directories can be a stepping stone to further malicious activity, such as uploading executable files, but the CVE description does not detail any subsequent exploitation.

WordPress sites running the WPvivid plugin (Backup, Migration & Staging) under any administrator or super‑user account, including all releases through and including 0.9.120.

The CVSS score of 2.7 reflects a low severity, and the EPSS score of less than 1 percent indicates a very small probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access with Administrator privileges, typically achieved through a legitimate admin session or compromise of such credentials. Once accessed, the attacker can create directories at will within the allowed file system paths. No public exploit code is documented, and the attack vector is local to the WordPress admin interface.