CVE-2025-5961

HIGH NUCLEI

WPvivid Backup & Migration < 0.9.116 - Authenticated Arbitrary File Upload via wpvivid_upload_import_files

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2025-5961. PoCs published by Boshe99, Nxploited, d0n601. A Nuclei detection template is also available.

AI-analyzed exploit summary The repository contains functional exploit code for CVE-2025-5961, targeting a WordPress plugin (3DPrint Lite 1.9.1.4) with an arbitrary file upload vulnerability. The Python script demonstrates the ability to upload a malicious file to a vulnerable target.

Description

The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvivid_upload_import_files' function in all versions up to, and including, 0.9.116. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: Uploaded files are only accessible on WordPress instances running on the NGINX web server as the existing .htaccess within the target file upload folder prevents access on Apache servers.

Exploits (3)

github WORKING POC
by Boshe99 · pythonpoc
https://github.com/Boshe99/CVE-Exploits/tree/main/CVE-2025-5961

The repository contains functional exploit code for CVE-2025-5961, targeting a WordPress plugin (3DPrint Lite 1.9.1.4) with an arbitrary file upload vulnerability. The Python script demonstrates the ability to upload a malicious file to a vulnerable target.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: WordPress Plugin 3DPrint Lite 1.9.1.4
No auth needed
Prerequisites: Vulnerable WordPress plugin installed · Network access to the target
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec WORKING POC
by Nxploited · poc
https://github.com/Nxploited/CVE-2025-5961

This is a functional exploit for CVE-2025-5961, targeting an arbitrary file upload vulnerability in the WPvivid Backup & Migration WordPress plugin. It authenticates as an administrator, extracts a nonce, and uploads a PHP web shell to achieve remote code execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Migration, Backup, Staging – WPvivid Backup & Migration <= 0.9.116
Auth required
Prerequisites: Valid administrator credentials · WPvivid Backup & Migration plugin installed and activated · Target plugin version <= 0.9.116
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by d0n601 · poc
https://github.com/d0n601/CVE-2025-5961

This PoC demonstrates an authenticated arbitrary file upload vulnerability in the WPvivid Backup & Migration plugin (CVE-2025-5961), allowing administrators to upload a PHP web shell via the `wpvivid_upload_import_files` action. The exploit includes a functional web shell for remote command execution.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: WPvivid Backup & Migration <= 0.9.116
Auth required
Prerequisites: WordPress admin credentials · Target running NGINX (Apache blocked by .htaccess)
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Nuclei Templates (1)

WordPress WPvivid Backup & Migration Plugin <= 0.9.116 - Authenticated Arbitrary File Upload
HIGHVERIFIEDby pussycat0x

References (7)

Core 7

Scores

CVSS v3 7.2
EPSS 0.0202
EPSS Percentile 84.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-434
Status published
Products (2)
wpvivid/migration\,_backup\,_staging < 0.9.117
wpvividplugins/WPvivid — Backup, Migration & Staging < 0.9.116
Published Jul 03, 2025
Tracked Since Feb 18, 2026