CVE-2024-13869

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-13869
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload_files' function in all versions up to, and including, 0.9.112. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: Uploaded files are only accessible on WordPress instances running on the NGINX web server as the existing .htaccess within the target file upload folder prevents access on Apache servers.
CVSS

No CVSS.

References
Link Resource
https://github.com/d0n601/CVE-2024-13869 Third Party Advisory Exploit
https://plugins.trac.wordpress.org/changeset/3242904/wpvivid-backuprestore Patch
https://ryankozak.com/posts/cve-2024-13869/ Product Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/0082e46d-fdbe-4ab7-bba3-0681a25d4495?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:wpvivid:wpvivid_backup_\&_migration:*:*:*:*:*:wordpress:*:*
History

05 Mar 2025, 21:28

Type Values Removed Values Added
First Time Wpvivid wpvivid Backup \& Migration
Wpvivid
CPE cpe:2.3:a:wpvivid:wpvivid_backup_\&_migration:*:*:*:*:*:wordpress:*:*
References () https://plugins.trac.wordpress.org/changeset/3242904/wpvivid-backuprestore - () https://plugins.trac.wordpress.org/changeset/3242904/wpvivid-backuprestore - Patch
References () https://github.com/d0n601/CVE-2024-13869 - () https://github.com/d0n601/CVE-2024-13869 - Third Party Advisory, Exploit
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/0082e46d-fdbe-4ab7-bba3-0681a25d4495?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/0082e46d-fdbe-4ab7-bba3-0681a25d4495?source=cve - Third Party Advisory
References () https://ryankozak.com/posts/cve-2024-13869/ - () https://ryankozak.com/posts/cve-2024-13869/ - Product, Exploit

23 Feb 2025, 04:15

Type Values Removed Values Added
References
  • () https://github.com/d0n601/CVE-2024-13869 -
  • () https://ryankozak.com/posts/cve-2024-13869/ -
CWE CWE-434
CVSS v2 : unknown
v3 : 7.2 		v2 : unknown
v3 : unknown

22 Feb 2025, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-22 13:15

Updated : 2025-03-05 21:28

NVD link : CVE-2024-13869

Mitre link : CVE-2024-13869

JSON object : View

Products Affected

wpvivid

  • wpvivid_backup_\&_migration
CWE

No CWE.