CVE-2024-56273: Medium Missing Authorization in WPvivid Backup

CVE-2024-56273 is a medium severity missing authorization flaw (CVSS 4.3) in the WPvivid Backup and Migration plugin for WordPress. Versions up to and including 0.9.106 are affected. Update the plugin to 0.9.107 or later, which Patchstack lists as the patched version.

What's affected

The CVE record describes a missing authorization vulnerability in WPvivid Backup and Migration (plugin slug wpvivid-backuprestore) that allows accessing functionality not properly constrained by access control lists. The affected range is from the earliest release through 0.9.106.

Patchstack's database entry, published 3 January 2025, lists 0.9.107 as the patched version. It rates the priority as low and says the issue is unlikely to be exploited. It also credits the researcher who reported it in October 2024. If you run any version at or below 0.9.106 on any WordPress site, you are in scope, including sites where the plugin is installed but not actively used.

How to check if you're exposed

With WP-CLI, one command lists the version:

wp plugin list --name=wpvivid-backuprestore --fields=name,status,version,update

Without it, open the Plugins page in the WordPress dashboard and read the version under the plugin name. For a fleet, run the same command on every site, or use your hosting provider's plugin inventory.

Also check inactive plugins. A deactivated plugin still has its files on disk, and some of its code can be reachable even when it is not running, depending on how it is built. If you are not using WPvivid, delete it rather than leaving it parked.

What to do now

1. List every WordPress site you manage and note the WPvivid version on each.
2. Update to 0.9.107 or later. WP-CLI users can run wp plugin update wpvivid-backuprestore.
3. If the plugin is not in use, remove it.
4. Review who has accounts on the site. The vector in the record shows low privileges required, so subscriber level accounts matter.
5. Check where your backups are stored and who can read them, since backup plugins handle sensitive data.
6. Turn on automatic updates for security releases, if your change process allows it.

Why it matters

The weakness is CWE-862, missing authorization. The plugin exposes a function without checking whether the person calling it is allowed to use it. This is the most common class of WordPress plugin bug. A developer adds a feature behind an admin screen, but the underlying action can be called directly, and nobody checks the caller's role again.

The score is medium and the vendor priority low, because the vector in the record shows a limited effect: no confidentiality or availability impact and a low integrity impact. Backup plugins deserve extra care anyway. They run with high access to files and databases, and a small authorization gap in a plugin like this can become a bigger one when combined with another weakness. The KEV flag in the record is false.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Patchstack entry for WPvivid 0.9.106

Last reviewed: 19 October 2026.