CVE-2026-1357 -- WPvivid RCE

Unauthenticated Remote Code Execution (RCE) in WPvivid Backup & Migration

800%2C000-brightgreen?style=for-the-badge" alt="Installs">

Critical flaw impacting over 800,000–900,000+ WordPress sites
Unauthenticated arbitrary PHP upload → full server compromise

---

🌩️ Overview

CVE-2026-1357 (CVSS 9.8 – Critical) affects the Migration, Backup, Staging – WPvivid Backup & Migration plugin (≤ 0.9.123).

• Plugin → WPvivid Backup & Migration
• Affected Versions → ≤ 0.9.123
• Patched Version → 0.9.124 (released ~January 28, 2026)
• Attack Vector → Network
• Complexity → Low
• Privileges Required → None
• User Interaction → None
• Impact → Remote Code Execution (High Confidentiality, Integrity, Availability impact)

The vulnerability exists in the plugin's optional "receive backup from another site" feature (via wpvivid_action=send_to_site). When enabled, an unauthenticated attacker can upload arbitrary files — most dangerously PHP webshells — to web-accessible locations like /wp-content/uploads/.

🛠️ Root Cause (Chained Vulnerabilities)

→ Attacker crafts payload encrypted with null key → bypasses "auth" → writes .php file anywhere writable.

🔥 Impact

• Unauthenticated remote code execution as the web server user (typically www-data)
• Full site compromise: backdoors, data exfiltration, ransomware, defacement
• Public PoCs appeared shortly after disclosure (Feb 2026)
• High real-world risk due to ease of exploitation and large install base

Note: Exploitation requires the "receive backup" feature to be enabled (non-default) and a valid/non-expired API token (max 24-hour lifetime).

📅 Timeline

🛡️ Mitigation & Hardening

Immediate Action
Upgrade to WPvivid Backup & Migration ≥ 0.9.124 (fixes: proper decryption failure handling, filename sanitization, file type restrictions).

Temporary Workarounds (if upgrade delayed):

• Disable "Receive backup from another site" in plugin settings
• Deactivate / delete the plugin if not needed
• Block /wp-admin/admin-ajax.php POSTs with action=wpvivid_send_to_site (via WAF / .htaccess)

Post-Incident Checks

• Search /wp-content/uploads/ (and other writable dirs) for suspicious .php files
• Review access logs for anomalous POSTs to admin-ajax.php
• Scan for webshells, rotate credentials, restore from clean backup if compromised

General Best Practices

• Keep WordPress core, themes, and plugins updated
• Use security plugins (Wordfence, Sucuri, etc.)
• Limit file permissions; disable XML-RPC if unused

🔗 References

• NVD Official Entry

• Wordfence Advisory (detailed disclosure)

• Plugin Page

• Nuclei Template: Official in projectdiscovery/nuclei-templates (added v10.4.0)

---

_{Patch early • Patch often • Stay secure}