WPvivid Backup & Migration plugin allows for arbitrary file upload which can lead to remote code execution.

source https://www.techradar.com/pro/security/nearly-a-million-wordpress-websites-could-be-at-risk-from-this-serious-plugin-security-flaw