Arbitrary file upload affecting the WPvivid Backup & Migration WordPress plugin
A critical vulnerability affecting the WPvivid Backup & Migration WordPress plugin would allow an unauthenticated malicious actor to upload arbitrary files to affected systems.
Description
Technical context and vulnerability details
WPvivid Backup & Migration is a WordPress plugin that allows you to migrate, backup and restore WordPress sites. It supports automatic backups, remote (cloud) storage and migration to another domain or hosting in just a few clicks. This plugin is affected by a critical vulnerability labeled CVE-2026-1357, resulting from incorrect error handling in the RSA decryption process and insufficient validation of paths when processing uploaded files. Exploitation of this vulnerability would allow an unauthenticated attacker to upload malicious files to server directories potentially leading to remote code execution. It is classified critical with a severity score of 9.8 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Remote Code Execution;
- Remote Arbitrary Code Execution;
- Compromise of system integrity;
Affected systems
Products, components and targeted versions
- All versions of the WPvivid Backup & Migration plugin before 0.9.124;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update WPvivid Backup & Migration plugin to the latest stable version;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.