WPvivid Migration, Backup, Staging arbitrary file upload (CVE-2020-36842)

CVE-2020-36842 is an arbitrary file upload vulnerability affecting the WPvivid Migration, Backup, Staging plugin for WordPress versions 0.9.35 and earlier. The flaw resides in the plugin's AJAX API, which allows authenticated users with subscriber-level privileges or higher to upload and extract arbitrary ZIP archives. By crafting a ZIP archive containing a PHP web shell, an attacker can extract malicious files to the web directory and achieve remote code execution (RCE).

Attack Chain

1. Attacker authenticates to the target WordPress site using a valid low-privileged account (Subscriber or above).
2. Attacker interacts with the WPvivid plugin AJAX API to initiate a file upload.
3. Attacker uploads a crafted ZIP archive containing a malicious PHP script.
4. Attacker triggers the plugin's import or extraction function via the AJAX API.
5. The plugin extracts the ZIP content, including the malicious PHP shell, to the server's web-accessible path (typically /wp-content/).
6. Attacker accesses the uploaded PHP script directly via a browser to execute arbitrary commands.

Impact

Successful exploitation allows authenticated users to achieve full remote code execution on the underlying server, potentially leading to unauthorized data access, site defacement, or further lateral movement within the hosting environment.

Recommendation

• Upgrade the WPvivid Migration, Backup, Staging plugin to the latest version immediately to remediate the vulnerability.
• Review WordPress user account permissions and restrict access to the WPvivid plugin functionality to administrative roles only.
• Implement server-side configurations to prevent direct script execution in the 'wp-content/uploads' directory using .htaccess or Nginx configuration blocks.
• Audit server access logs for anomalous POST requests to the WPvivid AJAX API followed by GET requests to newly created files in the /wp-content/ directory.