A critical vulnerability in the WPvivid Backup plugin exposes over 800,000 WordPress sites to unauthenticated remote code execution.
Discovered via Wordfence’s Bug Bounty Program, this flaw allows attackers to upload malicious files when sites enable a specific backup transfer feature.
The WPvivid Backup & Migration plugin, known as Migration, Backup, and Staging, suffers from an unauthenticated arbitrary-file-upload issue in versions up to 0.9.123. This carries a CVSS score of 9.8, rated critical, under CVE-2026-1357.
Attackers exploit it through the wpvivid_action=send_to_site parameter, leading to full site takeover via webshells or other payloads.
The flaw stems from poor error handling in RSA decryption and missing path sanitization. When openssl_private_decrypt() fails on a session key, it returns false, which phpseclib’s AES cipher interprets as null bytes, allowing attackers to craft predictable payloads.
The plugin then writes files without checking extensions or paths, enabling directory traversal to public areas for PHP execution.
This affects only sites with a generated receive key enabled, off by default, with a 24-hour max expiration. Still, active installations exceed 800,000, amplifying risk for misconfigured setups.
| CVE ID | CVSS Score | Affected Versions | Patched Version | Researcher |
|---|---|---|---|---|
| CVE-2026-1357 | 9.8 (Critical) | <= 0.9.123 | 0.9.124 | Lucas Montes (NiRoX) |
Technical Breakdown and Patch
In the send_to_site() function, the plugin decrypts POST data using a site-specific private key.
Failure passes the false AES key, defaulting to null bytes that attackers can predict and use for Rijndael encryption. Uploaded filenames lack sanitization, allowing escapes from the backup directory to web-accessible spots.
The decrypt_message() method skips checks on failed decryption and proceeds unthinkingly. No file-type validation occurs during upload, leaving the way open for PHP shells.
Attackers send crafted base64-encoded content via wpvivid_content, bypassing auth if the key feature activates.
Developers fixed it in 0.9.124 by adding the if ($key === false || empty($key)) { return false; } statement to decrypt_message(), halting invalid flows. They also enforced extensions such as zip, gz, tar, and sql in send_to_site() using preg_replace sanitization and in_array checks.
.webp)
Wordfence Premium, Care, and Response users got firewall rules on January 22, 2026; free users follow on February 21. Researcher Lucas Montes earned $2,145 through the program, which pays up to $31,200 per find.
Disclosure Timeline
Wordfence received the report on January 12, 2026, validated it, and contacted WPvivid on January 22. Vendor responded via email on January 23, provided details, and patched on January 28. Bounty paid post-fix; free protection delayed 30 days per policy.
.webp)
Users must update to 0.9.124 immediately from wordpress.org/plugins/wpvivid-backuprestore/. Turn off the receive key if unused. Wordfence urges sharing this advisory, as RCEs pose risks of data theft, defacement, or backdoors.
Wordfence’s bug bounty program aids ecosystem security and handles disclosures for free. Submit finds at wordfence.com/threat-intel/vulnerabilities/submit/. This multi-layer defense firewalls, patches, research bolsters WordPress resilience.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
