CVE-2024-13869

The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload_files' function in all versions up to, and including, 0.9.112. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: Uploaded files are only accessible on WordPress instances running on the NGINX web server as the existing .htaccess within the target file upload folder prevents access on Apache servers.

• CWE-434

• https://github.com/d0n601/CVE-2024-13869Exploit, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset/3242904/wpvivid-backuprestorePatch
• https://ryankozak.com/posts/cve-2024-13869/Exploit, Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/0082e46d-fdbe-4ab7-bba3-0681a25d4495?source=cveThird Party Advisory

Published

Feb 22, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-13863The Stylish Google Sheet Reader 4.0 WordPress plugin before…7.1
• CVE-2024-13864The Countdown Timer WordPress plugin through 1.0 does not sa…7.1
• CVE-2024-13865The S3Player WordPress plugin through 4.2.1 does not saniti…6.1
• CVE-2024-13866The Simple Notification plugin for WordPress is vulnerable t…6.4
• CVE-2024-13867The Listivo - Classified Ads WordPress Theme theme for WordP…6.1
• CVE-2024-13868The URL Shortener | Conversion Tracking | AB Testing | Woo…6.1
• CVE-2024-1387The Happy Addons for Elementor plugin for WordPress is vulne…4.3
• CVE-2024-13870An improper access control vulnerability exists in Bitdefend…5.7
• CVE-2024-13871A command injection vulnerability exists in the /check_image…8.8
• CVE-2024-13872Bitdefender Box, versions 1.3.11.490 through 1.3.11.505, use…7.5
• CVE-2024-13873The WP Job Portal – A Complete Recruitment System for Compan…4.3
• CVE-2024-13874The Feedify WordPress plugin before 2.4.6 does not sanitise…7.1