CVE-2025-5961

The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvivid_upload_import_files' function in all versions up to, and including, 0.9.116. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: Uploaded files are only accessible on WordPress instances running on the NGINX web server as the existing .htaccess within the target file upload folder prevents access on Apache servers.

• CWE-434

• https://github.com/d0n601/CVE-2025-5961Exploit, Third Party Advisory
• https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/trunk/includes/class-wpvivid-export-import.php#L2210Product
• https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/trunk/includes/class-wpvivid-export-import.php#L2235Product
• https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/trunk/includes/class-wpvivid-export-import.php#L2246Product
• https://plugins.trac.wordpress.org/changeset/3320877/Patch
• https://ryankozak.com/posts/cve-2025-5961/Exploit, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d8ceb4a1-9354-4ed3-9a8f-45ba2057a810?source=cveThird Party Advisory

Published

Jul 3, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-59601Information Disclosure when resetting device to factory defa…6.5
• CVE-2025-59603Memory Corruption when processing invalid user address with …7.8
• CVE-2025-59604Memory Corruption when running a memory copy operation due t…7.8
• CVE-2025-59605Memory Corruption when processing device identifier strings …7.8
• CVE-2025-59606Memory Corruption when writing to invalid memory locations o…7.8
• CVE-2025-59609Information Disclosure when processing advertisement frames …5.5
• CVE-2025-59610Memory Corruption when processing IOCTL requests with mismat…6.4
• CVE-2025-59611Memory corruption in diagnostic services due to absence of i…6.7
• CVE-2025-59612Memory corruption in windows drivers while sending incorrect…6.7
• CVE-2025-59613Memory Corruption when output buffer size is smaller than in…6.7
• CVE-2025-59614Memory Corruption when sending random number generator comma…6.7
• CVE-2025-59615Memory Corruption when invoking device input/output control …7.8