This vulnerability allows an authenticated user with Administrator privileges to upload arbitrary files to the WordPress site by exploiting missing file type validation in the wpvivid_upload_import_files function. Because the plugin does not restrict MIME types or extensions, an attacker can place malicious scripts or binaries on the server. On installations using NGINX, uploaded files become publicly accessible, enabling remote code execution. The flaw does not expose data by itself but can compromise the entire site if exploited.

The issue affects the WPvivid – Backup, Migration & Staging plugin for WordPress, specifically all releases up to and including 0.9.116. WordPress sites that have this plugin installed and are running in a user account that has Administrator or higher privileges are at risk. The vulnerability is relevant to any WordPress instance that accepts plugin uploads and is served by NGINX, where the plugin's upload folder is reachable.

The CVSS score of 7.2 indicates a high severity, while an EPSS score of 2% suggests a low to moderate likelihood that the vulnerability will be actively exploited. Because the flaw requires administrator credentials, it is constrained to sites with limited user accounts. The vulnerability is not listed in the CISA KEV catalog, implying no large scale exploitation detected yet. Nevertheless, the combination of authentication and weak file validation could be leveraged to gain remote code execution, especially on NGINX setups where the uploaded files are served directly.