The vulnerability exists in the WPvivid — Backup, Migration & Staging WordPress plugin before version 0.9.134. It allows an administrator, who can supply an arbitrary file name to the plugin’s file‑write functionality, to bypass normal path restrictions. The plugin will then place the file in a directory that may be outside the intended backup folder and can overwrite existing files if the file type is allowed. This flaw can enable an administrator to drop malicious files such as PHP scripts, alter critical configuration files, or replace content files, leading to complete compromise of the WordPress installation.

Consequences of the flaw are limited to WordPress sites that have the WPvivid plugin installed with a version older than 0.9.134. The plugin is used by site owners and administrators to back up and migrate content, and it runs with the same privileges as the WordPress administrator role. No other WordPress plugins or core components are affected directly by this issue, but any file that can be placed in the WordPress directory tree can be targeted.

Because the vulnerability is only exploitable by users who already have administrative access to the WordPress site, an attacker must first compromise or use a legitimate admin account. Once access is achieved, the attacker can exploit the flaw through the plugin’s file‑write endpoint, which accepts a file name without sanitization. The lack of an EPSS score and absence from the KEV catalog make it unclear how frequently this flaw is currently being used in the wild, but the potential for arbitrary file overwrite and the high level of privileges available to an administrator create a substantial risk. While the plugin’s functionality is intended for backup operations, the insecure handling of file names effectively turns it into an arbitrary file write primitive that can lead to remote code execution if the attacker is able to write an executable script.