CVE-2026-1357 — WPvivid Backup & Migration (Vuln vs Patched Docker Lab)

Local-only Docker lab for comparing WPvivid Backup & Migration:

• Vulnerable: 0.9.123
• Patched: 0.9.124

Built for learning practice (lab setup, verification, logs, notes). Anything PoC-related is intended to run only inside this lab on localhost.

Safety & scope

• Run this only on your own machine (localhost + Docker network).
• Do not target real sites/systems you don’t own or don’t have explicit permission to test.
• This repo is about a reproducible lab + verifiable artifacts (not an exploitation guide).

Quick start

docker compose up -d

Open:

• Vuln: http://localhost:8081
• Patched: http://localhost:8082

Admin (auto-seeded):

• user: admin
• pass: admin

Reset everything:

docker compose down -v

Verification

Generate the WPvivid key (manual, via UI)

1. Login to http://localhost:8081/wp-admin/ (or :8082)
2. Go to WPvivid Backup → Settings → Key
3. Generate a key

Screenshots

Vulnerable:

Patched:

Credits / References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-1357
• Original PoC reference: https://github.com/LucasM0ntes/POC-CVE-2026-1357

Disclaimer

This repository is for defensive research, education, and reproducible verification in a controlled environment. Do not use it against systems you don’t own or have permission to test.