Threats tagged 'ghsa-ffwc-7qpf-45gq'

The WPvivid — Backup, Migration & Staging WordPress plugin before version 0.9.137 contains a vulnerability where it does not properly validate the file extension of uploaded files during import. Specifically, it checks the extension of a separate request field but saves the uploaded file without WordPress's upload type-checking, allowing an authenticated administrator to store files with arbitrary extensions, including potentially executable PHP files, in the import directory. This issue is an incomplete fix of a previous vulnerability (CVE-2025-5961).