CVE-2025-5961: 
WordPress vulnerability analysis and mitigation

CVE-2025-5961 is an authenticated arbitrary file upload vulnerability in the Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress. It affects all versions up to and including 0.9.116, with the fix introduced in version 0.9.117. The flaw was published on July 3, 2025, and assigned by Wordfence. It carries a CVSS v3.1 base score of 7.2 (High) (Wordfence, Red Hat CVE).

The root cause is missing file type validation (CWE-434: Unrestricted Upload of File with Dangerous Type) in the wpvivid_upload_import_files AJAX action handler. Specifically, the upload_files function at line 2210 of class-wpvivid-export-import.php accepts a user-supplied filename via $_POST['name'] (line 2235) and writes the file directly to disk using fopen($path.$file_name, 'wb') (line 2246) without enforcing any allowlist of permitted file extensions (GitHub PoC, WP Trac). An attacker must be authenticated with Administrator-level privileges or higher. Exploitation is limited to NGINX-hosted WordPress instances, as the .htaccess file in the upload directory (/wp-content/wpvividbackups/ImportandExport/) blocks direct file access on Apache servers (GitHub PoC).

Successful exploitation allows an authenticated administrator to upload a PHP web shell or other malicious file to the server, enabling remote code execution (RCE) under the web server's process account. This can result in full compromise of the WordPress installation — including unauthorized access to the database, sensitive configuration files, and user data — as well as potential lateral movement to other services on the same host. The impact is most severe on NGINX-backed deployments where uploaded files are directly accessible via HTTP (Wordfence, GitHub PoC).

Multiple public proof-of-concept exploits exist, including a Python script (CVE-2025-5961.py) that automates login, nonce extraction, and web shell upload, as well as a second independent PoC repository (GitHub PoC, GitHub PoC2). A detailed technical write-up is also publicly available (Ryan Kozak Blog). The vulnerability has been incorporated into Nuclei detection templates (Nuclei Templates). The EPSS score is approximately 0.77%, and as of the available data, there is no confirmed in-the-wild exploitation and the CVE is not listed in the CISA KEV catalog (Feedly).

1. Reconnaissance: Identify WordPress sites running the WPvivid Backup & Migration plugin version ≤ 0.9.116 on NGINX. Tools like WPScan or Shodan can enumerate plugin versions on exposed WordPress installations.
2. Obtain Administrator credentials: This exploit requires valid WordPress Administrator (or higher) credentials, obtained via phishing, credential stuffing, or other means.
3. Authenticate and extract nonce: Log in to /wp-admin and retrieve the AJAX nonce value (ajax_nonce) required for the wpvivid_upload_import_files action. The PoC script automates this step.
4. Craft the upload request: Prepare a PHP web shell file (e.g., hack.php). To bypass front-end validation when doing this manually, first create a file with a valid-looking WPvivid backup filename (e.g., wpvivid-0000000000000_1969-04-20-00-00_export_post.zip), then intercept the upload request with Burp Suite and modify the name parameter to poc.php.
5. Upload the malicious file: Send a POST request to /wp-admin/admin-ajax.php with action=wpvivid_upload_import_files, the extracted nonce, and the PHP payload as the file body. The server writes the file to /wp-content/wpvividbackups/ImportandExport/poc.php.
6. Execute the web shell: Navigate to https://TARGET/wp-content/wpvividbackups/ImportandExport/poc.php in a browser or via curl to execute arbitrary commands on the server (GitHub PoC, Ryan Kozak Blog).

• Network: Unusual POST requests to /wp-admin/admin-ajax.php with action=wpvivid_upload_import_files containing non-ZIP/non-backup file content; subsequent GET requests to /wp-content/wpvividbackups/ImportandExport/*.php.
• File System: Unexpected .php files (e.g., hack.php, poc.php, shell.php) present in /wp-content/wpvividbackups/ImportandExport/; file timestamps inconsistent with legitimate backup activity.
• Logs: Web server access logs showing POST to admin-ajax.php with wpvivid_upload_import_files action followed by GET requests to PHP files in the wpvividbackups directory; WordPress debug logs recording unexpected file write operations.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget, python) after requests to the upload directory (GitHub PoC).

Update the WPvivid Backup & Migration plugin to version 0.9.117 or later, which introduces proper file type validation in the upload handler (WP Trac Patch). Sites running on NGINX should treat this as a priority, as the .htaccess protection present on Apache does not apply. If an immediate update is not possible on NGINX-hosted sites, consider temporarily disabling the plugin. Additionally, restrict WordPress Administrator access to trusted users only and monitor the /wp-content/wpvividbackups/ImportandExport/ directory for unexpected PHP files (Wordfence).

Wordfence, which assigned the CVE, published the vulnerability in its weekly WordPress vulnerability report for the week of June 30–July 6, 2025 (Wordfence Blog). Sucuri also included it in their July 2025 WordPress vulnerability patch roundup (Sucuri Blog). RedPacketSecurity shared the vulnerability on social media shortly after disclosure, and Trend Micro added it to their threat encyclopedia in September 2025 (Trend Micro). Community reaction has been moderate, with multiple independent PoC authors publishing exploit code within days of disclosure.