WPvivid Backup EUVD-2026-59918

Exploitation requires the attacker to hold a valid WPvivid site-to-site transfer key; the vulnerable code path is reachable from an unauthenticated HTTP request, but the transfer-key requirement is the real gating prerequisite and limits who can exploit it. The attacker must also target an existing, writable directory on the site (e.g. the web root or an uploads path) for the log file to be created there. What limits real-world impact: the attacker cannot control the file's name suffix or its contents (always the plugin's own log header), so this yields arbitrary file placement, not arbitrary content write or code execution; the site-to-site transfer feature must be in use for a valid key to exist.

The published CVSS 3.1 score is 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N), but this appears inflated relative to the described behaviour and should be treated with caution. The C:H rating is hard to justify because the vulnerability writes a file rather than reads data, and the I:H rating overstates impact because the description explicitly says only the file's location is attacker-controlled - the filename suffix is fixed and the contents are always the plugin's own log header, so an attacker cannot plant executable PHP or overwrite content of their choosing, which rules out the usual traversal-to-RCE path. PR:N is also questionable: exploitation requires the attacker to hold a valid site-to-site transfer key, so in practice possession of a secret is needed even though the vulnerable code path is reachable from an unauthenticated request. Supporting real-world signals are modest - EPSS is 0.16% (6th percentile) and the CVE is not in CISA KEV - while a public POC exists via WPScan. Net assessment: a genuine unauthenticated-reachable path traversal worth patching, but the practical severity is materially lower than 9.1; treat it as a medium-priority fix rather than a critical RCE, and verify the transfer-key prerequisite and true impact against the vendor advisory.

An attacker who has obtained a valid site-to-site transfer key sends an unauthenticated request to the vulnerable endpoint containing directory-traversal sequences in the value used to build the log path. The plugin writes its standard log file, with its fixed suffix and header content, into the attacker-specified writable directory such as the web root. A public POC for the flaw is available via WPScan, and because the vector is network-based with low complexity, the request itself is trivial to craft once a key is held.