CVE-2026-1357

Migration, Backup, Staging - WPvivid Backup & Migration, a WordPress backup and migration plugin, is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to and including 0.9.123. The flaw combines two errors in the plugin's encrypted transfer feature: when RSA decryption of a session key fails via openssl_private_decrypt(), the plugin continues anyway, and the phpseclib AES library treats the returned boolean 'false' as a key made of null bytes, letting attackers forge properly encrypted payloads with a predictable key. Because filenames taken from the decrypted payload are never sanitized, directory traversal lets an attacker write PHP files outside the protected backup directory into publicly accessible folders, all triggered by an unauthenticated request containing the wpvivid_action=send_to_site parameter. Any WordPress site running the plugin at version 0.9.123 or earlier is affected, with no authentication or user interaction required, consistent with the maximum-range 9.8 CVSS score. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but the EPSS score of 32.7% (98th percentile) implies roughly a one-in-three chance of exploitation within 30 days.

What to do: Upgrade WPvivid Backup & Migration to a release newer than 0.9.123 on every site where it is installed as soon as a patched version is available. Until patched, block or restrict unauthenticated requests containing wpvivid_action=send_to_site (e.g., via WAF rules) and check web-accessible directories for unexpectedly created PHP files. Although no exploitation is confirmed yet, the high EPSS score (~33% within 30 days) warrants urgent patching.