Migration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File Upload
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.
Summary
The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Upload in versions up to and including 0.9.123. This is due to improper error handling in the RSA decryption process combined with a lack of path sanitization when writing uploaded files. When the plugin fails to decrypt a session key using openssl_private_decrypt(), it does not terminate execution and instead passes the boolean false value to the phpseclib library's AES cipher initialization. The library treats this false value as a string of null bytes, allowing an attacker to encrypt a malicious payload using a predictable null-byte key. Additionally, the plugin accepts filenames from the decrypted payload without sanitization, enabling directory traversal to escape the protected backup directory. This makes it possible for unauthenticated attackers to upload arbitrary PHP files to publicly accessible directories and achieve Remote Code Execution via the wpvivid_action=send_to_site parameter.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| wpvividplugins | WPvivid — Backup, Migration & Staging | up to 0.9.123 | — | No fix listed | CNA |
- WPvivid — Backup, Migration & Staging Vendorwpvividplugins Affected up to 0.9.123 Fixed in — No fix listed CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wpvivid:migration\,_backup\,_staging:*:*:*:*:*:*:*:* | — | — | wpvividplugins |
- cpe:2.3:a:wpvivid:migration\,_backup\,_staging:*:*:*:*:*:*:*:* Versions — — ·wpvividplugins
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-1357
- 2026-10-03 Alias added: GHSA-3cvp-fw5m-7w6r
References
Other 8
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e5af0317-ef46-4744-9752-74ce228b5f37?source=cve
- https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/trunk/includes/class-wpvivid-crypt.php#L58
- https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/tags/0.9.122/includes/class-wpvivid-crypt.php#L58
- https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/tags/0.9.123/includes/class-wpvivid-crypt.php#L58
- https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/trunk/includes/customclass/class-wpvivid-send-to-site.php#L629
- https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/tags/0.9.122/includes/customclass/class-wpvivid-send-to-site.php#L629
- https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/tags/0.9.123/includes/customclass/class-wpvivid-send-to-site.php#L629
- https://plugins.trac.wordpress.org/changeset/3448386/wpvivid-backuprestore#file1
More wpvividplugins vulnerabilities
- TI-2024-06776 Migration, Backup, Staging – WPvivid < 0.9.106 - Unauthenticated Sensitive Data Exposure CVSS 3.1HIGH 7.5
- TI-2025-05384 Unrestricted file upload in wpvividplugins WPvivid — Backup, Migration & Staging CVSS 3.1HIGH 7.2
- TI-2024-12890 Migration, Backup, Staging – WPvivid <= 0.9.112 - Authenticated (Admin+) Arbitrary File Upload via wpvivid_upload_file CVSS 3.1HIGH 7.2
- TI-2024-02860 WPvivid Backup & Migration Plugin <= 0.9.99 - Authenticated (Admin+) PHAR Deserialization CVSS 3.1HIGH 7.2
- TI-2024-01843 SQL injection in wpvividplugins Migration, Backup, Staging – WPvivid CVSS 3.1CRITICAL 9.8
- TI-2024-01844 WPvivid Backup and Migration <= 0.9.68 - Missing Authorization CVSS 3.1CRITICAL 9.1
Sources
- CVE-2026-1357 · CVE Program
- CVE-2026-1357 · NVD
- FIRST EPSS
- GHSA-3cvp-fw5m-7w6r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences