Loading vulnerability…
Unauthenticated Arbitrary File Upload and RCE in WPvivid Backup & Migration
CVE-2026-1357 is a critical vulnerability in the Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress affecting versions through 0.9.123. The flaw allows unauthenticated arbitrary file upload and can be escalated to remote code execution. The root cause is a compound failure in the plugin’s backup-receive workflow: when RSA session-key decryption via openssl_private_decrypt() fails, execution does not stop, and the resulting boolean false value is passed into phpseclib AES initialization. That value is effectively treated as a predictable null-byte key, allowing an attacker to craft encrypted payloads that the plugin will accept. The plugin also fails to sanitize attacker-controlled filenames extracted from the decrypted payload, enabling directory traversal outside the intended protected backup location. By abusing the send-to-site action, an attacker can write arbitrary files, including server-executable PHP content, into web-accessible directories.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits unauthenticated attackers to place arbitrary files on the target WordPress server and, where executable content can be written to a web-accessible location, achieve remote code execution. This can result in full compromise of the affected website, deployment of webshells or other persistence mechanisms, theft of application data and credentials, modification or destruction of site content, malware staging, and use of the compromised host as a pivot for further intrusion.
If you can’t patch tonight, do this now.
If immediate patching is not possible, disable or deactivate the vulnerable plugin or specifically disable the feature that receives backups from another site if operationally feasible. Reduce unauthenticated exposure to the vulnerable action through network access controls, reverse-proxy restrictions, or WAF filtering. Harden the web server so writable upload or backup directories cannot execute PHP or other server-side code, and monitor for unexpected file creation and suspicious child processes spawned by the web server.
Patch, then assume compromise.
Upgrade WPvivid Backup & Migration to version 0.9.124 or later. Because exploitation can result in arbitrary file placement and code execution, remediation should also include incident-response validation on previously exposed systems: inspect web-accessible writable directories for unauthorized server-side scripts, review application and web-server logs for exploitation attempts against the vulnerable backup-receive action, remove any malicious persistence, rotate potentially exposed credentials, and restore from a known-good backup if compromise is confirmed.
9 exploits validated by Mallory's analysis. Hidden: 3 rejected by Mallory's analysis as not a working exploit; 1 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
45 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.