vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2020-36842

Migration, Backup, Staging – WPvivid <= 0.9.35 - Authenticated (Subscriber+) Arbitrary File Upload

HIGH
8.8
CVSS Score
Published: October 16, 2024 at 07:31 AM UTC
Updated: June 17, 2026 at 03:16 AM UTC
1 product affected across 1 vendorMigration Backup Staging

Using Migration, Backup, Staging – WPvivid by wpvividplugins?

Get instant alerts when new vulnerabilities affect Migration, Backup, Staging – WPvivid - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH8.8
Exploit prediction
EPSS 1%
SSVC
No known exploit

Description

The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the wpvivid_upload_import_files and wpvivid_upload_files AJAX actions that allows low-level authenticated attackers to upload zip files that can be subsequently extracted. This affects versions up to, and including 0.9.35.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Migration Backup Staging· Wpvividpluginswordpress-plugin
95%
v ≤ 0.9.35

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (3)

Patch
Source: [email protected]
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2261665%40wpvivid-backuprestore%2Ftrunk&old=2252870%40wpvivid-backuprestore%2Ftrunk&sfp_email=&sfph_mail=
Broken Link
Source: [email protected]
https://www.webarxsecurity.com/vulnerability-in-wpvivid-backup-plugin-can-lead-to-database-leak/?fbclid=IwAR3Ve74ZIvmx-aC0OssIWYwcWEjGq6yU16DcyVGHD1XUT3uYaZ3QyVu_Eos&utm_content=buffer4435b&utm_medium=social&utm_source=facebook.com&utm_campaign=buffer
Third Party Advisory
Source: [email protected]
https://www.wordfence.com/threat-intel/vulnerabilities/id/de1da248-2e03-40fa-8997-7176dc06abc9?source=cve

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.8HIGHWordfence
Vector?

Quick Info

StatusANALYZED
CWE
CWE-434

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card