CVE-2025-12654: 
WordPress vulnerability analysis and mitigation

CVE-2025-12654 is an arbitrary directory creation vulnerability in the Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress, affecting all versions up to and including 0.9.120. The flaw stems from the check_filesystem_permissions() function failing to properly restrict which directories can be created or their location. It was published on December 21, 2025, with Wordfence credited as the assigning authority. The vulnerability carries a CVSS v3.1 base score of 2.7 (Low), requiring Administrator-level authentication to exploit (Wordfence, Red Hat CVE).

The root cause is classified as CWE-73: External Control of File Name or Path, where user-supplied input is passed to the check_filesystem_permissions() function without adequate path restriction, allowing an attacker to specify arbitrary filesystem locations for directory creation. Exploitation requires network access and a valid Administrator-level WordPress account; no user interaction is needed. The vulnerable code is present in includes/staging/class-wpvivid-staging.php at lines 1535, 1568, and 1571 of the 0.9.120 release (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated administrator to create arbitrary directories anywhere on the server filesystem that the web server process has write access to. While confidentiality and availability are not directly impacted (CVSS scores both as None), the integrity impact is Low — an attacker could create directories in sensitive locations to facilitate further attacks such as path traversal, log pollution, or staging malicious content. The practical risk is limited by the requirement for Administrator-level credentials, but in multi-tenant or compromised environments it could contribute to privilege escalation chains (Wordfence).

The EPSS score is extremely low at 0.007%, reflecting minimal likelihood of automated exploitation. No confirmed in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA KEV catalog. Notably, several GitHub repositories claim to offer "RCE exploit builders" for CVE-2025-12654 under the AnyDesk branding (e.g., Kastowm/Anydesk-Exploit-CVE-2025-12654-RCE-Builder), but these are widely assessed to be malicious bait repositories targeting other threat actors — a "hackers hacking hackers" campaign documented by Sophos and Antiy, distributing backdoored malware (Sakura RAT) rather than legitimate PoC code (Sophos, Antiy).

1. Authentication: Log in to the target WordPress site with an Administrator-level account (or higher).
2. Identify plugin: Confirm the WPvivid Backup & Migration plugin (version ≤ 0.9.120) is installed and active via the WordPress admin dashboard or by probing /wp-content/plugins/wpvivid-backuprestore/.
3. Trigger vulnerable function: Send a crafted authenticated HTTP request to the plugin's staging functionality, supplying a manipulated directory path parameter that bypasses the check_filesystem_permissions() validation logic.
4. Create arbitrary directory: The server creates the attacker-specified directory at the chosen filesystem path (e.g., outside the WordPress root), which could be used to stage further payloads or manipulate server structure.
5. Leverage for follow-on actions: Use the newly created directory as a stepping stone for additional attacks, such as placing files in predictable locations or interfering with server operations (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing authenticated POST requests to WPvivid staging endpoints with unusual or traversal-style directory path parameters (e.g., ../../, absolute paths outside wp-content).
• File System: Unexpected new directories created outside the normal WordPress directory structure (e.g., in /tmp, server root, or parent directories of the web root) owned by the web server process user.
• Process: Web server process (e.g., apache, nginx, php-fpm) creating directories in atypical filesystem locations.
• WordPress Logs: Entries in WordPress debug logs referencing class-wpvivid-staging.php with unexpected path values passed to filesystem functions.

Update the WPvivid Backup & Migration plugin to a version above 0.9.120, which includes the fix restricting directory creation paths in check_filesystem_permissions(). The patch is available via the WordPress plugin repository. As a temporary workaround, restrict Administrator access to trusted users only and consider deactivating the plugin's staging functionality until the update is applied. Review the changelog at the WordPress plugin repository for the specific patched version (WordPress Plugin, WordPress Trac Changeset).

Sophos published a notable investigation into the misuse of this CVE identifier, documenting a campaign where threat actors created fake "AnyDesk exploit" repositories on GitHub using the CVE-2025-12654 label to lure other cybercriminals into downloading backdoored malware (Sakura RAT) — a "hackers hacking hackers" scheme (Sophos). Antiy also published analysis of these poisoned open-source project impersonation campaigns (Antiy). The @attritionorg account on social media flagged the misleading CVE-to-product association. Community sentiment notes the irony that the CVE's notoriety stems more from its abuse as bait than from the underlying WordPress vulnerability itself.