WPvivid Backup & Migration < 0.9.131 - Unauthenticated Path Traversal via send_to_site_connect

Description

The plugin does not sanitise a value taken from an unauthenticated request before using it to build a log file path, allowing an attacker holding a site to site transfer key to create a log file in any existing writable directory of the site, including the web root.

The file name always carries a fixed suffix and the contents are always the plugin's own log header, so only the location of the file is attacker controlled.