Loading story…
A critical vulnerability in the WordPress plugin WPvivid Backup & Migration (aka Migration, Backup, Staging – WPvivid Backup & Migration) allows unauthenticated arbitrary file upload leading to remote code execution (RCE) on affected sites. Tracked as CVE-2026-1357 with CVSS 9.8, the issue impacts plugin versions <= 0.9.123 and is tied to the plugin’s remote transfer functionality (send_to_site() / wpvivid_action=send_to_site), which processes incoming backup data from other sites.
Technical details indicate the exploit chain combines broken cryptographic error handling with unsafe file write behavior: when openssl_private_decrypt() fails, execution continues and a false value is passed into AES initialization, which is treated as a predictable null-byte key. Attackers can craft payloads encrypted with this null-byte key to bypass intended protections, then leverage missing file validation (and reported lack of filename/path sanitization enabling directory traversal) to write attacker-controlled files (e.g., PHP web shells) into web-accessible locations, enabling full site takeover and data access (including database contents).
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
A ProjectDiscovery Nuclei templates pull request proposed detection for vulnerable WPvivid instances by checking plugin version and probing the send_to_site endpoint for a WPvivid-specific error response. The submission also documented a locally validated exploit chain using the fail-open crypto condition and path traversal to place a web-accessible file.
Subsequent reporting detailed the root cause as RSA decryption error handling that could fall back to a predictable null-byte AES key, combined with unsafe path handling that enabled directory traversal and PHP upload. Coverage also described the vendor patch behavior and mitigation guidance such as upgrading, rotating keys, and checking for unexpected PHP files.
Wordfence said it had observed and blocked attacks targeting CVE-2026-1357, indicating active probing or exploitation attempts following disclosure. The activity was tied to the vulnerable send_to_site functionality.
Public reporting disclosed CVE-2026-1357 as a critical unauthenticated arbitrary file upload vulnerability in WPvivid Backup & Migration, enabling remote code execution on sites using affected versions up to 0.9.123. Reports noted the highest risk applied when the non-default site-to-site backup receiving feature was enabled.
WPVividPlugins released WPvivid Backup & Migration version 0.9.124 to address the vulnerability. The fix added decryption-failure checks, filename sanitization, and file-type restrictions on uploads.
After validating a proof-of-concept for the WPvivid vulnerability, Defiant notified the vendor WPVividPlugins about the issue. This advanced coordinated disclosure of the flaw affecting versions up to 0.9.123.
Researcher Lucas Montes (NiRoX) reported a critical unauthenticated file upload and remote code execution flaw in the WPvivid Backup & Migration WordPress plugin to Defiant. The issue later became tracked as CVE-2026-1357.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcesecurityonline.info
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple WordPress plugins were found vulnerable to **unauthenticated arbitrary file upload** flaws that can lead to remote code execution and full site compromise. The most urgent case involves the **Breeze Cache** plugin, where **CVE-2026-3844** affects versions through `2.4.4` when the optional **"Host Files Locally - Gravatars"** feature is enabled. Researchers said the bug stems from missing file-type validation in the `fetch_gravatar_from_remote` function, and BleepingComputer reported that attackers are already exploiting the issue in the wild, with Wordfence observing more than 170 attack attempts. Cloudways released a fix in version `2.4.5`, and defenders were urged to update immediately or disable the Gravatar-related feature until patching is complete. Two additional **Contact Form 7** upload extensions were also disclosed with critical upload weaknesses. **CVE-2026-5718** affects **Drag and Drop Multiple File Upload for Contact Form 7** through `1.3.9.6`, where custom blacklist handling can override the default dangerous-extension denylist and a non-ASCII filename trick can bypass sanitization, allowing attackers to upload PHP files. **CVE-2026-5364** affects **Drag and Drop File Upload for Contact Form 7** through `1.1.3`, where the plugin validates an unsanitized extension but saves a sanitized one, enabling bypasses using special characters such as `$`; researchers noted that `.htaccess` protections and filename randomization may reduce real-world exploitability. Together, the disclosures highlight a broader pattern of insecure file validation in WordPress upload plugins.
Jun 29, 2026
A critical authentication bypass in the **UpdraftPlus: WP Backup & Migration** WordPress plugin, tracked as `CVE-2026-10795`, is being actively exploited against sites running versions up to and including `1.26.4`. The flaw affects a plugin installed on more than three million WordPress sites and stems from insufficient validation in UpdraftCentral remote procedure call handling, including signature-verification weaknesses and unchecked decryption return values that can collapse to a predictable all-zero key. Wordfence reported blocking **4,987** exploitation attempts in a 24-hour period. Successful exploitation lets unauthenticated attackers impersonate the connected administrator and issue arbitrary RPC actions, including uploading and auto-activating a malicious plugin for **remote code execution** and full site compromise. The vulnerability has been classified under `CWE-347`, with a `CVSS v3.1` vector of `AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`. The issue was reportedly discovered by researcher **vtim**, and the vendor released a patch that adds stricter return-value validation; administrators are being urged to update immediately.
Jun 29, 2026
A critical vulnerability tracked as **`CVE-2026-58480`** affects the **Blocksy Companion Pro** WordPress plugin before version **`2.1.47`**, allowing unauthenticated attackers to achieve remote code execution through arbitrary file upload. The flaw is exposed via the **Advanced Reviews** feature's `save_attachments` function and stems from a flawed `strpos()` substring validation in the **Custom Fonts** extension. By submitting a double-extension payload such as `shell.woff2.php`, an attacker can bypass extension checks and upload a file that the server may execute as PHP. The issue has been rated **CVSS 9.8** under v3.1 and **9.2** under v4.0, with reporting indicating active scanning for vulnerable sites. Successful exploitation could lead to full compromise of the WordPress instance and potentially the underlying server. The vendor has addressed the flaw in **version `2.1.47`**, and organizations running Blocksy Companion Pro are advised to upgrade immediately and, if patching is delayed, disable the **Advanced Reviews** feature and verify that file upload restrictions are properly enforced.
Jul 9, 2026