News Vulnerability In WPvivid Backup Plugin Could Expose Files Of WordPress Sites

[Mr.Kurd]

In The Name OF Allah

Al-Salam Alekum

Hey guys looks like WP came back again with a big hole lol!

Reportedly, the security team from WebARX found a vulnerability in the WPvivid Backup WordPress plugin. As stated in their advisory, the critical flaw could allow an authenticated user to meddle with the default backup location.

The most critical registered wp_ajax action that does not have an authorization check would be wp_ajax_wpvivid_add_remote.

It allows any authenticated user, regardless of their user role, to add a new remote storage location and set it as the default backup location.

This would result in the backup being made on the new default location set up by the attacker upon execution of the plugin.


This not only causes an unwanted exposure of sensitive data files of the website but may also cause data loss. Likewise, this would also allow the adversary to lure a site admin to execute an action from the plugin.

The Source

Wa Salam Alekum