The WPvivid — Backup, Migration & Staging WordPress plugin versions prior to 0.9.131 do not sanitize a value obtained from an unauthenticated request before using it to construct a log file path. This improper limitation of a pathname to a restricted directory (CWE-22) enables an attacker possessing a site-to-site transfer key to create a log file in arbitrary writable directories on the site, including the web root. The file name includes a fixed suffix and the contents are the plugin's own log header, so only the file location is attacker-controlled.

An attacker with a site-to-site transfer key can write a log file to any writable directory on the server, including the web root. Although the file content is fixed and not attacker-controlled, placing files in arbitrary locations could potentially be leveraged for further attacks such as overwriting legitimate files or facilitating other malicious activities depending on the server configuration. No direct code execution or data disclosure is described.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict or monitor the use of site-to-site transfer keys and limit writable directories to reduce the risk of arbitrary file creation. Avoid exposing the plugin to untrusted users with transfer keys.