An unauthenticated arbitrary file upload issue exists due to improper error handling during the RSA decryption process and a lack of path sanitization when writing uploaded files. When the plugin fails to decrypt a session key using `openssl private decrypt()`, it passes a boolean false value to the phpseclib library's AES cipher initialization. The library interprets this false value as a string of null bytes, allowing an attacker to encrypt a malicious payload using a predictable null-byte key. Furthermore, the plugin accepts filenames from the decrypted payload without sanitization, enabling directory traversal to escape the protected backup directory. This allows unauthenticated attackers to upload arbitrary PHP files to publicly accessible directories and achieve Remote Code Execution via the `wpvivid action=send to site` parameter. Approximately 800,000 WordPress sites are potentially affected, specifically those with the receive backup from another site feature enabled.