WPvivid Backup & Migration < 0.9.117 - Admin+ Arbitrary File Upload

Description

The plugin is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvivid_upload_import_files' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: Uploaded files are only accessible on WordPress instances running on the NGINX web server as the existing .htaccess within the target file upload folder prevents access on Apache servers.