Migration, Backup, Staging – WPvivid Backup & Migration <= 0.9.120 - Authenticated (Admin+) Arbitrary Directory Creation

This research plan targets CVE-2025-12654, an authenticated arbitrary directory creation vulnerability in the WPvivid Backup & Migration plugin.

1. Vulnerability Summary

The vulnerability exists in the check_filesystem_permissions() function (or the AJAX handler calling it) within the WPvivid plugin. The function accepts a user-supplied path to check if it is writable. If the directory does not exist, the plugin attempts to create it using wp_mkdir_p() without properly restricting the location to the plugin's intended backup or staging directories. This allows an authenticated administrator to create arbitrary directories anywhere the web server has write permissions.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: wpvivid_check_path_permissions (inferred from function name and plugin naming conventions) or wpvivid_check_filesystem_permissions.
• Payload Parameter: path or dir (POST parameter).
• Authentication: Authenticated, Administrator level (manage_options capability).
• Preconditions: The plugin must be active.

3. Code Flow (Inferred)

1. Entry Point: The administrator triggers an AJAX request, likely from the "Settings" or "Staging" tabs, intended to verify if a custom backup path is usable.
2. Hook Registration: The plugin registers an AJAX action: add_action('wp_ajax_wpvivid_check_path_permissions', [...]).
3. Vulnerable Function: The handler calls check_filesystem_permissions().
4. Processing:

   // Simplified logic based on vulnerability description
   public function check_filesystem_permissions() {
       $path = $_POST['path']; // Input from user
       if (!file_exists($path)) {
           wp_mkdir_p($path); // Sink: Recursive directory creation
       }
       // ... returns success/fail based on is_writable($path)
   }
   

5. Sink: wp_mkdir_p() executes the directory creation without validating that the $path is within WP_CONTENT_DIR or a specific allowed subfolder.

4. Nonce Acquisition Strategy

The WPvivid plugin localizes its AJAX data for the admin dashboard. Since this is an Admin+ vulnerability, we must log in as an administrator first.

1. Login: Authenticate as the administrator.
2. Locate Nonce: Navigate to the WPvivid Backup dashboard (/wp-admin/admin.php?page=WPvivid).
3. Extraction: The nonce is typically stored in a global JavaScript object named wpvivid_ajax_object.
4. JS Command:

   browser_eval("wpvivid_ajax_object.ajax_nonce")
   

   Note: If wpvivid_ajax_object is not present, search the page source for wp_create_nonce patterns or variables ending in _nonce.

5. Exploitation Strategy

Step 1: Authenticate and Extract Nonce

• Use browser_navigate to log into the WordPress admin panel.
• Navigate to http://localhost:8080/wp-admin/admin.php?page=WPvivid.
• Execute browser_eval("wpvivid_ajax_object.ajax_nonce") to retrieve the nonce.

Step 2: Execute Arbitrary Directory Creation

• Construct a POST request to admin-ajax.php.
• Target a path outside the standard backup directory (e.g., in wp-content/uploads/poc_dir_12654).

HTTP Request Details:

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers:
  • Content-Type: application/x-www-form-urlencoded
  • Cookie: [Admin Session Cookies]
• Body Parameters:

  action=wpvivid_check_path_permissions&nonce=[NONCE]&path=[ABSOLUTE_PATH_TO_WP]/wp-content/uploads/poc_directory
  

  (Note: If wpvivid_check_path_permissions returns 400, try action=wpvivid_check_filesystem_permissions)

6. Test Data Setup

1. User: An administrator account (default admin / password).
2. Plugin: Install and activate WPvivid Backup & Migration version 0.9.120.
3. Target Path: Identify the absolute path to the WordPress installation (usually /var/www/html).

7. Expected Results

• Response: The server should return a JSON object, likely {"status":"success"} or similar, indicating the path is writable (because the plugin created it).
• Filesystem Change: A new directory named poc_directory (or the chosen name) should appear at the specified path.

8. Verification Steps

1. Check Directory Existence via CLI:

   ls -ld /var/www/html/wp-content/uploads/poc_directory
   

2. Check Permissions:
   Verify the directory is owned by the web server user (e.g., www-data).
3. Clean up:

   rmdir /var/www/html/wp-content/uploads/poc_directory
   

9. Alternative Approaches

• Traversal Payloads: If absolute paths are blocked, try relative paths using traversal: path=wp-content/backups/../../../../tmp/wpvivid_poc.
• Action Name Brute-force: If the AJAX action name differs in version 0.9.120, grep the plugin directory for the string check_filesystem_permissions to find the associated wp_ajax hook:

  grep -r "wp_ajax_wpvivid_" /var/www/html/wp-content/plugins/wpvivid-backuprestore/
  

• Parameters: If path is not the key, check for dir, check_path, or root_path in the source of includes/class-wpvivid.php.