{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3awpvividmigration%5C_backup%5C_stagingwordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wpvivid:migration_backup_staging:*:*:*:*:*:wordpress:*:*","cpe:2.3:a:wpvivid:migration\\,_backup\\,_staging:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2020-36842"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WPvivid Migration, Backup, Staging (\u003c= 0.9.35)"],"_cs_severities":["high"],"_cs_tags":["web-application","wordpress","rce","cve-2020-36842"],"_cs_type":"advisory","_cs_vendors":["WPvivid"],"content_html":"\u003cp\u003eCVE-2020-36842 is an arbitrary file upload vulnerability affecting the WPvivid Migration, Backup, Staging plugin for WordPress versions 0.9.35 and earlier. The flaw resides in the plugin's AJAX API, which allows authenticated users with subscriber-level privileges or higher to upload and extract arbitrary ZIP archives. By crafting a ZIP archive containing a PHP web shell, an attacker can extract malicious files to the web directory and achieve remote code execution (RCE).\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to the target WordPress site using a valid low-privileged account (Subscriber or above).\u003c/li\u003e\n\u003cli\u003eAttacker interacts with the WPvivid plugin AJAX API to initiate a file upload.\u003c/li\u003e\n\u003cli\u003eAttacker uploads a crafted ZIP archive containing a malicious PHP script.\u003c/li\u003e\n\u003cli\u003eAttacker triggers the plugin's import or extraction function via the AJAX API.\u003c/li\u003e\n\u003cli\u003eThe plugin extracts the ZIP content, including the malicious PHP shell, to the server's web-accessible path (typically /wp-content/).\u003c/li\u003e\n\u003cli\u003eAttacker accesses the uploaded PHP script directly via a browser to execute arbitrary commands.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows authenticated users to achieve full remote code execution on the underlying server, potentially leading to unauthorized data access, site defacement, or further lateral movement within the hosting environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the WPvivid Migration, Backup, Staging plugin to the latest version immediately to remediate the vulnerability.\u003c/li\u003e\n\u003cli\u003eReview WordPress user account permissions and restrict access to the WPvivid plugin functionality to administrative roles only.\u003c/li\u003e\n\u003cli\u003eImplement server-side configurations to prevent direct script execution in the 'wp-content/uploads' directory using .htaccess or Nginx configuration blocks.\u003c/li\u003e\n\u003cli\u003eAudit server access logs for anomalous POST requests to the WPvivid AJAX API followed by GET requests to newly created files in the /wp-content/ directory.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-28T08:50:13Z","date_published":"2026-10-28T08:50:13Z","id":"https://feed.craftedsignal.io/briefs/2026-10-wpvivid-rce/","summary":"An authenticated remote code execution vulnerability (CVE-2020-36842) in the WPvivid WordPress plugin allows low-privileged users to achieve code execution via ZIP archive file uploads.","title":"WPvivid Migration, Backup, Staging arbitrary file upload (CVE-2020-36842)","url":"https://feed.craftedsignal.io/briefs/2026-10-wpvivid-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:wpvivid:migration\\,_backup\\,_staging:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}