CVE-2020-36842

HIGH

The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the wpvivid_upload_import_files and wpvivid_upload_files A...

Affects 1 product across 1 vendor.

CVSS 3.18.8
EPSS1.2%
Percentile67th
PatchPatched
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, low privileges required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-434: Unrestricted Upload of File with Dangerous Type

Application allows file uploads without validating type, enabling upload of executable code or web shells.

Related Attack Patterns (CAPEC)
CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs
via CWE-434

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check, allowing low-level authenticated attackers to upload and extract zip files.

BSID: BS-2024-GLOBAL-238464-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2020-36842?
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check, allowing low-level authenticated attackers to upload and extract zip files.
What is the CVSS score for CVE-2020-36842?
CVE-2020-36842 has CVSS 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS: 1.2%.
Is CVE-2020-36842 actively exploited?
No confirmed active exploitation of CVE-2020-36842 as of 2026-05-30.
How do I remediate CVE-2020-36842?
Priority: IMMEDIATE.
What systems are affected by CVE-2020-36842?
CVE-2020-36842 affects Wpvivid Migration, Backup, Staging.
Vulnerability Details
CVE IDCVE-2020-36842
BSIDBS-2024-GLOBAL-238464-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published2024-10-16
Last Modified2024-10-30
ICS Relevance0%
Weakness (CWE)
Unrestricted Upload of File with Dangerous Type
SourceNVD
Official Description

The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the wpvivid_upload_import_files and wpvivid_upload_files AJAX actions that allows low-level authenticated attackers to upload zip files that can be subsequently extracted. This affects versions up to, and including 0.9.35.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability exists in the wpvivid_upload_import_files and wpvivid_upload_files AJAX actions within the WPvivid plugin. Attackers can exploit this by uploading malicious zip files, which can then be extracted on the server, potentially leading to remote code execution.

Exploitation Likelihood: HIGH

Affected Products
VendorProductAffected Versions
Wpvivid Migration, Backup, Staging ≤ 0.9.35
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 730 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash014f1550b21daecfd5743ddd493e0171d11688a47d79df4736be1a817860c2f964c36bef2e4b4fe3cfd2f52d13e667ea049fc79848b1bd86f66e90099e2c0fb4
Related CVEs affecting Wpvivid
CVE-2026-1357 9.8 The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPr... CVE-2024-56273 9.8 Missing Authorization vulnerability in wpvividplugins WPvivid Backup and Migr... CVE-2023-5576 9.3 The Migration, Backup, Staging - WPvivid plugin for WordPress is vulnerable t... CVE-2024-1981 9.1 The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable t... CVE-2024-1982 9.1 The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable t...
View all Wpvivid CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →