{"affected":[{"defaultStatus":"unaffected","product":"WPvivid — Backup, Migration & Staging","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"0.9.137","status":"affected","version":"0.9.117","versionType":"semver"}]}],"cveId":"CVE-2026-115243","cwes":["CWE-434"],"description":"The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not validate the extension of the file it actually stores when handling an import upload: it checks the extension of a separate request field while saving the uploaded file itself with WordPress's upload type-checking disabled, so an authenticated administrator can store a file with an arbitrary extension, including a PHP file, in the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137's import directory. This is an incomplete fix of CVE-2025-5961, whose extension check was applied to the wrong value.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/07de0f63-657d-4f97-b665-468e2dff7776/"}],"kev":null,"metrics":[],"modifiedAt":1793772026847,"publishedAt":1793772026847,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/07de0f63-657d-4f97-b665-468e2dff7776/"}],"remediation":[],"revision":"78989d464c9357e9487d93d2ac331aa4d013ac49c1ef68c71f532d31b5d01d6e","sources":[{"modifiedAt":1793772026847,"name":"CNA: WPScan","retrievedAt":1793776132696,"url":"https://www.cve.org/CVERecord?id=CVE-2026-115243"}],"ssvc":null,"status":"published","title":"WPvivid Backup & Migration 0.9.117 - 0.9.136 - Admin+ Arbitrary File Upload via wpvivid_upload_import_files","updatedAt":1793776132696}