CVE-2020-36842 Migration, Backup, Staging – WPvivid <= 0.9.35 - Authenticated (Subscriber+) Arbitrary File Upload

What is CVE-2020-36842?

CVE-2020-36842 is a high-severity vulnerability in wpvividplugins WPvivid — Backup, Migration & Staging, published on 16 Oct 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the wpvivid_upload_import_files and wpvivid_upload_files AJAX actions that allows low-level authenticated attackers to upload zip files that can be subsequently extracted. This affects versions up to, and including 0.9.35.

Weakness: CWE-434

Which versions are affected by CVE-2020-36842?

It affects 1 product.

Products include Wpvivid Migration\, Backup\, Staging.

How do I fix CVE-2020-36842?

No fix has been published for CVE-2020-36842 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-36842 being exploited?

There is no known exploitation of CVE-2020-36842 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in wpvividplugins WPvivid — Backup, Migration & Staging

• CVE-2024-1981 SQL injection in Migration, Backup, Staging – WPvivid Critical 9.8
• CVE-2024-10962 Migration, Backup, Staging – WPvivid <= 0.9.107 - Unauthenticated PHP Object Injection High 8.8
• CVE-2023-41243 WordPress WPvivid Backup Plugin plugin <= 0.9.90 - Privilege Escalation on Staging Environment vulnerability High 8.8
• CVE-2023-4274 Path traversal in Migration, Backup, Staging – WPvivid High 8.7
• CVE-2023-5576 Migration, Backup, Staging – WPvivid <= 0.9.91 - Google Drive Client Secret Exposure High 8.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6636-f7qc-6vpx.