CVE-2025-12654

Executive Summary

CVE-2025-12654 is a vulnerability in the WordPress plugin WPvivid Backup & Migration (versions up to and including 0.9.120). The flaw resides in the check_filesystem_permissions() function, which fails to properly restrict directory creation paths. An authenticated attacker with Administrator-level access can exploit this to create arbitrary directories on the server's filesystem. While the CVSS score is low (2.7) due to the high privileges required and limited direct impact, this vulnerability can be chained with other attacks (e.g., writing files into newly created directories) to escalate privileges or achieve remote code execution. No public proof-of-concept (PoC) or exploit code is currently available.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. It does not affect Apache, Nginx, or PHP core. The plugin is widely used for backup and migration tasks, making it a target for attackers who have already compromised an administrator account.

CVSS Breakdown & Threat Level

• CVSS Score: 2.7 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Administrator)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (arbitrary directory creation)
• Availability Impact: None

Threat Level: Low. The vulnerability requires administrator-level access, which limits its exploitability. However, in multi-tenant WordPress environments or after a privilege escalation, it could be used to stage further attacks.

Deep Dive & Mechanics

The vulnerability exists in the check_filesystem_permissions() function within the WPvivid Backup & Migration plugin. This function is intended to verify that the plugin has write permissions to necessary directories (e.g., backup storage). However, due to insufficient input validation and path sanitization, an attacker can supply a crafted path (e.g., using directory traversal sequences like ../) to create directories outside the intended scope.

Root Cause: The function does not restrict the base directory for creation. It likely uses user-supplied input (e.g., from plugin settings or API calls) to construct a path without checking for traversal or absolute path usage.

Attack Flow:

1. Attacker authenticates as an Administrator.
2. Attacker sends a crafted request (e.g., via the plugin's AJAX handler) to create a directory at a malicious path, such as /var/www/html/wp-content/plugins/malicious.
3. The plugin creates the directory, which can then be used to store malicious files (e.g., a PHP webshell) if combined with a file upload vulnerability.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the check_filesystem_permissions() function. A patched version would:

• Validate that the target directory is within an allowed base path (e.g., WP_CONTENT_DIR).
• Use realpath() to resolve symlinks and traversal sequences.
• Reject paths containing .. or absolute paths outside the allowed scope.

Vulnerable Code (Conceptual):

function check_filesystem_permissions($dir) {
    // No validation of $dir
    if (!file_exists($dir)) {
        mkdir($dir, 0755, true);
    }
    return is_writable($dir);
}

Patched Code (Conceptual):

function check_filesystem_permissions($dir) {
    $allowed_base = WP_CONTENT_DIR . '/wpvivid-backup';
    $real_dir = realpath($dir);
    if (strpos($real_dir, $allowed_base) !== 0) {
        return false; // Reject paths outside allowed base
    }
    if (!file_exists($dir)) {
        mkdir($dir, 0755, true);
    }
    return is_writable($dir);
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress admin credentials.
• Network access to the WordPress admin dashboard.

Steps:

1. Log in as an administrator.
2. Navigate to the WPvivid Backup plugin settings.
3. Intercept the request (e.g., using Burp Suite) that triggers directory creation (likely via an AJAX call to admin-ajax.php with action wpvivid_create_directory).
4. Modify the dir parameter to a path like ../../../wp-content/plugins/malicious.
5. Send the request. The directory is created.
6. If a file upload vulnerability exists (e.g., in the same plugin or another), upload a webshell to the new directory.

Example Request (Burp):

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target.com
Cookie: [admin cookie]

action=wpvivid_create_directory&dir=../../../wp-content/plugins/malicious

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual directory creation events in the WordPress filesystem.
• Look for AJAX requests to admin-ajax.php with suspicious dir parameters containing .. or absolute paths.
• Audit admin user activity for unexpected plugin settings changes.

Hardening:

• Apply the principle of least privilege: restrict admin access to trusted users only.
• Use a Web Application Firewall (WAF) to block requests with directory traversal patterns.
• Monitor file integrity using tools like Tripwire or OSSEC.
• If possible, disable the plugin until a patch is released.

Indicators of Compromise (IOCs)

• File System: Unexpected directories created outside the plugin's intended path (e.g., /var/www/html/wp-content/plugins/unusual_name).
• Logs: WordPress debug logs showing mkdir() calls with suspicious paths.
• Network: AJAX requests to admin-ajax.php with action=wpvivid_create_directory and dir parameter containing ../.
• Process: PHP processes creating directories in non-standard locations.

Detection Engineering

YARA Rule

rule CVE_2025_12654_WPvivid_Directory_Creation {
    meta:
        description = "Detects attempts to exploit CVE-2025-12654 in WPvivid Backup plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-12654"
    strings:
        $ajax_action = "wpvivid_create_directory"
        $dir_param = "dir="
        $traversal = ".."
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-12654 WPvivid Directory Creation Exploit
id: cve-2025-12654-sigma
status: experimental
description: Detects HTTP requests attempting to exploit arbitrary directory creation in WPvivid Backup plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=wpvivid_create_directory'
        cs-uri-query|contains: 'dir='
        cs-uri-query|contains: '..'
    condition: selection
falsepositives:
    - Legitimate plugin operations (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-12654 WPvivid Directory Creation Exploit"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=wpvivid_create_directory"; http_client_body; content:"dir="; http_client_body; content:".."; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Review admin accounts and remove any unnecessary privileged users.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Apply the vendor patch when available.
• Implement input validation and path sanitization in custom code.
• Use a WordPress security plugin (e.g., Wordfence) to detect and block directory traversal attempts.

Workaround:

• Modify the plugin code to restrict directory creation to a safe base path (see patched code example above). This is not recommended for non-developers.

Valters IT
DevSecOps & Cyber Threat Intelligence