CVE-2026-1357

Name of the Vulnerable Software and Affected Versions Migration, Backup, Staging – WPvivid Backup & Migration versions prior to 0.9.124

Description An unauthenticated arbitrary file upload issue exists due to improper error handling during the RSA decryption process and a lack of path sanitization when writing uploaded files. When the plugin fails to decrypt a session key using openssl private decrypt(), it passes a boolean false value to the phpseclib library's AES cipher initialization. The library interprets this false value as a string of null bytes, allowing an attacker to encrypt a malicious payload using a predictable null-byte key. Furthermore, the plugin accepts filenames from the decrypted payload without sanitization, enabling directory traversal to escape the protected backup directory. This allows unauthenticated attackers to upload arbitrary PHP files to publicly accessible directories and achieve Remote Code Execution via the wpvivid action=send to site parameter. Approximately 800,000 WordPress sites are potentially affected, specifically those with the receive backup from another site feature enabled.

Recommendations Update Migration, Backup, Staging – WPvivid Backup & Migration to version 0.9.124 or later. Disable the receive backup from another site feature if it is not necessary.