The WPvivid Backup, Migration & Staging plugin for WordPress contains an arbitrary directory creation vulnerability (CWE-73) in all versions up to and including 0.9.120. This occurs because the check_filesystem_permissions() function does not properly restrict where directories can be created, enabling authenticated administrators to create directories at arbitrary locations. The CVSS 3.1 base score is 2.7, reflecting low severity with network attack vector, low complexity, high privileges required, no user interaction, and limited impact on integrity only.

An attacker with Administrator-level access can create arbitrary directories on the file system where the plugin operates. This could potentially be used to manipulate the file system structure but does not directly lead to confidentiality or availability impacts. There are no known exploits in the wild. The impact is limited due to the requirement for high privileges and no direct data disclosure or service disruption.

No official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor's advisory channels for updates. Since exploitation requires Administrator-level access, ensuring strict access controls and limiting administrator accounts can reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.