Hundreds of thousands of websites could be exposed after researchers discovered a critical flaw in a popular WordPress backup plugin. The WPvivid RCE vulnerability enables attackers to execute code remotely and fully control affected sites. Because the plugin is widely used for migration and backup tasks, many administrators may not realize the feature can open a serious security gap.
Remote takeover through backup feature
The vulnerability affects the WPvivid Backup & Migration plugin installed on more than 900,000 websites. Attackers can abuse a backup transfer function to upload malicious files and run them on the server.
This attack does not require login credentials when the feature is enabled. A successful exploit grants full access to the website, including files, database content, and administrative controls.
What causes the vulnerability
The WPvivid RCE vulnerability originates from improper validation during the restore and transfer process. When encryption fails, the plugin continues processing instead of rejecting the request. Attackers can predict values used in the process and craft a malicious backup payload.
At the same time, weak file path filtering allows directory traversal. This lets attackers place executable files outside the intended backup directory and run them directly on the site.
Real-world exposure
Only sites using the remote backup receive function face direct exploitation. However, administrators often enable this option temporarily during migrations, leaving it active longer than expected.
The authentication token used by the feature expires after a limited time window, but attackers can still exploit it quickly once detected.
Patch released
Developers fixed the WPvivid RCE vulnerability in a newer plugin version. The update improves validation, blocks unsafe file types, and stops processing when decryption fails.
Site owners should update immediately and disable unused migration tools after completing transfers.
Why this flaw is serious
Backup plugins operate with the highest permissions inside WordPress. If compromised, attackers can inject malware, steal stored data, redirect visitors, or create persistent administrator accounts.
That makes these tools high-value targets for automated scanning campaigns.
Conclusion
The WPvivid RCE vulnerability shows how maintenance features can unintentionally become entry points for attackers. A single enabled option can expose an entire website to takeover.
Keeping plugins updated and disabling temporary migration settings significantly reduces risk. In modern WordPress security, unused functionality can be as dangerous as outdated software.
0 responses to “WPvivid RCE vulnerability puts 900K WordPress sites at risk”