CVE-2025-12654
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory creation in all versions up to, and including, 0.9.120. The check_filesystem_permissions() function does not properly restrict the directories that can be created or their location, allowing authenticated attackers with Administrator-level access to create arbitrary directories.
Risk Assessment
An attacker with administrator privileges could create directories in arbitrary locations, potentially cluttering the filesystem or enabling further attacks.
Recommendation
Update the WPvivid Backup & Migration plugin to a version later than 0.9.120 that contains the fix.
Other vulnerabilities in WPvivid Backup & Migration
See all- CVE-2026-17555Medium
The WPvivid Backup & Migration plugin for WordPress up to version 0.9.131 contains a SQL Injection vulnerability via the export_data parameter. Authenticated attackers with administrator-level access and above can append additional SQL queries to existing queries, allowing extraction of sensitive database information.
- CVE-2025-12656Low
Vulnerability in the WPvivid Backup & Migration WordPress plugin (up to version 0.9.128) allows an authenticated attacker with Administrator-level access to delete arbitrary directories on the server via the delete_cancel_staging_site() function due to insufficient path validation.
Original NVD description (English source)
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory creation in all versions up to, and including, 0.9.120. This is due to the check_filesystem_permissions() function not properly restricting the directories that can be created, or in what location. This makes it possible for authenticated attackers, with Administrator-level access and above, to create arbitrary directories.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS