CVE-2023-41243 is a high severity (CVSS 8.8) privilege escalation flaw in the WPvivid Backup and Migration plugin for WordPress, in versions through 0.9.90. Patchstack lists 0.9.91 as the patched version. Update the plugin on every site, including staging copies, because the advisory ties the issue to the staging environment.
What's affected
The NVD record says WPvivid Backup and Migration is affected "from n/a through 0.9.90". Patchstack, whose page we read, lists 0.9.90 and earlier as vulnerable and 0.9.91 as the patched version. Both sources agree on the severity class: the record scores 8.8 and Patchstack labels it high priority.
The Patchstack URL names the issue as a privilege escalation on the staging environment. We did not find a vendor advisory beyond that page.
The record scores the flaw 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. It can be reached over the network, the attack complexity is low, it requires low privileges, and it needs no user interaction. The impact on confidentiality is high, on integrity high and on availability high. The weakness classes are CWE-269 (improper privilege management) and CWE-862 (missing authorization). The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
Check the plugin version on every WordPress site you run. If you have WP-CLI access:
wp plugin get wpvivid-backuprestore --fields=name,status,version
Or open Plugins in the dashboard and read the version under WPvivid Backup and Migration. Anything at or below 0.9.90 is in the affected range. The fixed version per Patchstack is 0.9.91. Do not forget staging copies and rarely visited sites, and remove plugins you no longer use.
What to do now
- Update WPvivid Backup and Migration to 0.9.91 or later. With WP-CLI:
wp plugin update wpvivid-backuprestore. - Check staging and cloned sites separately and update them too.
- Review the list of users with elevated roles on each site and remove any you do not recognise.
- If you cannot update today, deactivate the plugin until you can, and take backups some other way in the meantime.
Why it matters
The weakness classes are CWE-269, improper privilege management, and CWE-862, missing authorization. In plain terms, the plugin did not check strictly enough who is allowed to do a privileged action. The vector shows the attacker needs a low privileged account, but no user interaction.
Backup plugins hold the keys to a site: database dumps, config files and sometimes remote storage credentials. Privilege escalation in one is serious even at a modest install count. Patchstack also notes that issues like this are used in mass campaigns against WordPress sites, though we found no statement that this one is exploited.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which WPvivid version fixes CVE-2023-41243?
Patchstack lists 0.9.91 as the patched version. The record says versions through 0.9.90 are affected.
Is it on the CISA KEV list?
No. The record has the KEV flag set to false.
Sources
Last reviewed: 19 October 2026.
