CVE-2020-36842
Published: April 11, 2026
Official Description
The Migration, Backup, Staging -WPvivid plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the wpvivid_upload_import_files and wpvivid_upload_files AJAX actions that allows low-level authenticated attackers to upload zip files that can be subsequently extracted. This affects versions up to, and including 0.9.35.
Risk Analysis
The Migration, Backup, Staging - WPvivid plugin for WordPress is vulnerable to arbitrary file uploads, allowing low-level authenticated attackers to upload and extract zip files. This flaw is actively exploited, as confirmed by its presence in the CISA KEV catalog, posing a risk of remote code execution.
This vulnerability is actively exploited in the wild. Attackers require low-level authenticated access to exploit this flaw, which can lead to further compromise.
Update the Migration, Backup, Staging - WPvivid plugin to a version beyond 0.9.35. Implement strict file upload restrictions and regularly scan your WordPress installation for unauthorized files.
Technical Analysis
CVE-2020-36842 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CISA has added CVE-2020-36842 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
Affected Vendors & Products
Exploit & PoC Resources
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2020-36842 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1